IIS shortname scanner vulnerability for IIS Based Distributed Repository

[youngpae1]

Our Internal Security Scanner found that our dedicated Windows IIS Servers for internal facing HTTP Distributed Repositories are exposed to IIS ShortName scanner vulnerability:

https://github.com/irsdl/iis-shortname-scanner/

The fix seems to be as easy as to run

• fsutil 8dot3name set 1
• fsutil 8dot3name strip /s /f D:\IIS

But setting 8dot3name to disable is the reverse of typical ePO Server installation best practice (for VSE AP Long filename/short file name resolution).

Question is... is this safe for EPO Managed Distributed Repository?

I think so but I want to make sure.

Thanks,

Young-

[Hawkmoon · Accepted solution]

Hi youngpae1,

Yes, the repository should be OK.

I offer the following  as information.
This article as it has a rather good description (in the 'Cause' section) of 'issues' '8 dot 3' can cause if its not accounted for correctly.

Unable to log on to the ePO console after migrating ePO to a new server
Technical Articles ID: KB84177

[cdinet]

It is not required for a distributed repository, only for the epo server itself.