A serious ASP.NET exploit has been discovered. It can be used to decrypt viewstate, remotely log in as any user and potentially gain control over a server.
http://www.youtube.com/watch?v=yghiC_U2RaM
The exploit works by firing thousands of requests at a website, examining the returned error messages for information and eventually collecting enough information to derive the server's encryption key. Any ASP.NET website that doesn't return a static error page can be hacked using this method.
http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment