Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Hi there,
There is an issue with role permissions that is being worked on at the moment.
If you are having trouble with access or permissions on regional forums please post here to get access: https://www.boards.ie/discussion/2058365403/you-do-not-have-permission-for-that#latest

ASP.NET Vulnerability

  • 21-09-2010 10:48pm
    #1
    Ronan_
    Closed Accounts Posts: 48 ✭


    This might interest some of you..
    Vulnerability affecting all versions of ASP.NET discovered
    To understand how this vulnerability works, you need to know about cryptographic oracles. An oracle in the context of cryptography is a system which provides hints as you ask it questions. In this case, there is a vulnerability in ASP.NET which acts as a padding oracle. This allows an attacker to send cipher text to the web server and learn if it was decrypted properly by examining which error code was returned by the web server. By making many such requests (and watching what errors are returned) the attacker can learn enough to successfully decrypt the rest of the cipher text.

    This could allow an attacker to read Viewstate or download any file from a server e.g. web.config

    Make sure CustomErrors is set on, and that all errors are being sent to one generic error page. This page should return as little information as possible to the user.


Advertisement