I installed the new Security Analyzer 8.1.0 to our DNN 9.1.1 installations as advised but I'm getting results from different areas even though 9.1.1 inherently has the fixes in it.

If I go to PersonaBar -> Gear -> Security -> Security Analyzer I see;
     CheckTelerikVulnerability : Check if Telerik component has vulnerability.
     PASS
     Telerik Component already patched.

However if I go to PersonaBar -> Wrenches -> Security -> Security Analyzer I see;
     CheckTelerikVulnerability : Check if Telerik component has vulnerability.
     FAIL
    The Telerik component vulnerability has not been patched, please go to http://www.dnnsoftware.com/services/customer-support/success-network/security-fix-june-2017 for detailed information.
     You also can download a patch from that page or directly from http://dnn.ly/SecurityFix201701 and apply it.
     App Setting "Telerik.Web.UI.DialogParametersEncryptionKey" doesn't exist in web.config.

Which looking back through the previous security bulletins and also our patched 9.1.0 systems there is no mention of Telerik.Web.UI.DialogParametersEncryptionKey needing to be set or it even existing in any of our web.config files.

I put in an encryption key in the web.config to try to fix a problem I had with the first patch.

Please follow instructions here to add it: http://docs.telerik.com/devtools/aspn...



Ensure you replace the VALUE with a string that is at least 64 bytes long.

---

Ash Prasad
Director of Engineering
DNN Corp.