Microsoft Security Advisory Warns of .NET Vulnerability

Posted 09/21/2010 at 7:19am | by Paul Lilly

2

Comments

Print

Microsoft this week updated one of its Security Advisory (2416728) detailing a vulnerability in ASP.NET that could allow hackers to sniff through your data.

"Microsoft is investigating a new public report of a vulnerability in ASP.NET. An attacker who exploited this vulnerability could view data, such as the View State, which was encrypted by the target server, or read data from files on the target server, such as web.config," the Security Advisory reads. "This would allow the attacker to tamper with the contents of the data. By sending back the altered contents to an affected server, the attacker could observe the error codes returned by the server. Microsoft is aware of limited, active attacks at this time."

The security hole affects all versions of the .NET Framework and several versions of Windows, including Windows 7, Vista, XP, Server 2003, Server 2008, and Server 2008 R2.

As of right now, there really isn't anything you can do, at least until Microsoft completes its investigation. When it does, the Redmond outfit said it may provide an out-of-cycle security update.