There is a known vulnerability in ASP.NET that could allow a hacker to access areas of a web site that relys on the <authorization> section of the web.config file for security. BVC 2004 does use this section to protect the /bvconfigure folder but other areas, like the /BVAdmin folder, are protected by a custom security check that isn't vulnerable to this type of attack.


A quick fix is available by adding a few lines to your global.asax.vb file or by running the latest IIS6 with URLScan. You can read more about this security issue here:



http://www.microsoft.com/security/incident/aspnet.mspx