Active Server Pages error 'ASP 0131' Disallowed Parent Path

This is the error I get:
Active Server Pages error 'ASP 0131'
Disallowed Parent Path
/confrerie/restricted/result.asp, line 2
The Include file '../Connections/connconf.asp' cannot contain '..' to
indicate the parent directory.

<%@LANGUAGE="JAVASCRIPT" CODEPAGE="1252"%>
<!--#include file="../Connections/connconf.asp" -->
<%

Changing this to:
<%@LANGUAGE="JAVASCRIPT" CODEPAGE="1252"%>
<!--#include
file="C:/inetpub/wwwroot/confrerie/Connections/connconf.asp" -->
<%
Gives another error:
Active Server Pages error 'ASP 0126'
Include file not found
/confrerie/restricted/result.asp, line 2
The include file
'C:/inetpub/wwwroot/confrerie/Connections/connconf.asp' was not found.

I use IIS 6.0 and windows 2003.

Egbert
Sun Oct 30 05:12:08 CST 2005


"Xwardox" <xwardox@xs4all.nl> wrote in message
news:1130670189.130274.38700@g49g2000cwa.googlegroups.com...
> This is the error I get:
> Active Server Pages error 'ASP 0131'
> Disallowed Parent Path
> /confrerie/restricted/result.asp, line 2
> The Include file '../Connections/connconf.asp' cannot contain '..' to
> indicate the parent directory.
>
> <%@LANGUAGE="JAVASCRIPT" CODEPAGE="1252"%>
> <!--#include file="../Connections/connconf.asp" -->
> <%
>
> Changing this to:
> <%@LANGUAGE="JAVASCRIPT" CODEPAGE="1252"%>
> <!--#include
> file="C:/inetpub/wwwroot/confrerie/Connections/connconf.asp" -->
> <%
> Gives another error:
> Active Server Pages error 'ASP 0126'
> Include file not found
> /confrerie/restricted/result.asp, line 2
> The include file
> 'C:/inetpub/wwwroot/confrerie/Connections/connconf.asp' was not found.

This is the default setting for IIS 6
from the MSDN:Active Server Pages error 'ASP 0131'
Disallowed ParentPath
/ipdiss/admin/DispNCOA.asp, line 4
The Include file '../include/functions.inc'
cannot contain '..' to indicate the parent directory.
Is there some security issue that's being addressed here?

A Yes, there is a security issue. The metabase property AspEnableParentPaths
has been changed by default from TRUE to FALSE in IIS 6.0. Restricting
ParentPaths reduces an attacker's ability to traverse the file system and do
things like snagging the local SAM store or firing up a cmd.exe shell.



> I use IIS 6.0 and windows 2003.
>

Xwardox
Sun Oct 30 05:47:52 CST 2005

Thanks, for this confrerie-site it was enabled, but not for the default
website. After changing that the script proceeded. I'm not sure if I'm
at high risk now and I'm not sure if there is an alternative.

The next error at line 5 is probably also about security:
Microsoft OLE DB Provider for ODBC Drivers error '80004005'
[Microsoft][ODBC Driver Manager] Driver's SQLSetConnectAttr failed
/confrerie/restricted/result.asp, line 5

Regards Xwardox

Egbert
Sun Oct 30 13:06:20 CST 2005


"Xwardox" <xwardox@xs4all.nl> wrote in message
news:1130672872.336825.205860@g14g2000cwa.googlegroups.com...
> Thanks, for this confrerie-site it was enabled, but not for the default
> website. After changing that the script proceeded. I'm not sure if I'm
> at high risk now and I'm not sure if there is an alternative.

You are not at high risk but if you have a script, that uses
Scripting.FileSystemObject, you should care about it that it has -no-
relation with your asp page parameters.

> The next error at line 5 is probably also about security:
> Microsoft OLE DB Provider for ODBC Drivers error '80004005'
> [Microsoft][ODBC Driver Manager] Driver's SQLSetConnectAttr failed
> /confrerie/restricted/result.asp, line 5
>

If you are using Access you have so much possible errors that I even do not
try to fix it :< 80004005 mostly means access denied.


If not, try to use a native SQL provider
provider=sqloledb;data source=yourserver; initial catalog=yourdb;user
id=youruser;password=*****

--
compatible web farm Session replacement for Asp and Asp.Net
http://www.nieropwebconsult.nl/asp_session_manager.htm