Published: May 27, 2008

Version: 1.0

Maximum Severity Rating: Low

Background

Whilst installing DotNetNuke a number of files are used to coordinate the intallation or upgrade of a portal.

Issue Summary

Whilst these files are necessary for installation/upgrade of DotNetNuke, they are left behind after the process finishes. Potential hackers can use these files to determine what version of DotNetNuke is running. This information could help them to target versions with known security issues, anf therefore, need to be removed to protect against security profiling.

Mitigating factors

N/A

Affected DotNetNuke versions

3.0 - 4.8.2 inclusive.

Non-Affected Versions:

All other versions

Fix(s) for issue

To fix this problem, you are recommended to update to the latest version of DotNetNuke (4.8.3 at time of writing).

If you are unable to upgrade to the latest version, you can alternatively remove all of the *.txt files from the /Portals/_default folder. This will protect your site from being susceptible to automated security scanners or other probing tools typically used by malicious parties.

Acknowledgments

Security Policy

Click here to read more details on the DotNetNuke Security Policy