Right, but all the vulnerability walkthroughs I saw involved using the vulnerability to get super-user status and then using that status to do other nefarious things.
If you don't have user authentication of any kind, is there any threat? If nobody can login to my site, can the site's web.config still be accessed, for example. Dylan. ________________________________ From: [email protected] [mailto:[email protected]] On Behalf Of KO CHANG Sent: Wednesday, 29 September 2010 11:12 AM To: ozDotNet Subject: Re: IMPORTANT - ASP.NET update and security advisory The vulnerability addressed is the ASP.NET<http://ASP.NET> Padding Oracle Vulnerability at http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3332 Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET<http://ASP.NET> in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack. On Wed, Sep 29, 2010 at 11:09 AM, Dylan Tusler <[email protected]<mailto:[email protected]>> wrote: If you are not using any authentication on your site are you affected? Dylan. -----Original Message----- From: [email protected]<mailto:[email protected]> [mailto:[email protected]<mailto:[email protected]>] On Behalf Of silky Sent: Wednesday, 29 September 2010 11:08 AM To: ozDotNet Subject: Re: IMPORTANT - ASP.NET<http://ASP.NET> update and security advisory On Wed, Sep 29, 2010 at 10:36 AM, <[email protected]<mailto:[email protected]>> wrote: > Question - does this just affect people using Oracle, or does it affect all > .net instances? It affects everyone using .NET. Specifically it also affects FormsAuthentication, which most of us are probably using somewhere. You *must* implement the fix described ASAP. Everyone working on an ASP.NET<http://ASP.NET> should read the advisory, check if they are vulnerable and fix it. > T. -- silky http://dnoondt.wordpress.com/ "Every morning when I wake up, I experience an exquisite joy - the joy of being this signature." ------------------------------------------------------------- To find out more about the Sunshine Coast Regional Council, visit your local office at Caloundra, Maroochydore, Nambour or Tewantin or visit us online at www.sunshinecoast.qld.gov.au<http://www.sunshinecoast.qld.gov.au>. If correspondence includes personal information, please refer to Council's Privacy Policy at http://www.sunshinecoast.qld.gov.au . This email and any attachments are confidential and only for the use of the addressee. If you have received this email in error you are requested to notify the sender by return email or contact council on 1300 00 7272 and are prohibited from forwarding, printing, copying or using it in anyway, in whole or part. Please note that some council staff utilise Blackberry devices, which results in information being transmitted overseas prior to delivery of any communication to the device. In sending an email to Council you are agreeing that the content of your email may be transmitted overseas. Any views expressed in this email are the author's, except where the email makes it clear otherwise. The unauthorised publication of an email and any attachments generated for the official functions of council is strictly prohibited. Please note that council is subject to the Right to Information Act 2009 (Qld) and Information Privacy Act 2009 (Qld). ------------------------------------------------------------- To find out more about the Sunshine Coast Regional Council, visit your local office at Caloundra, Maroochydore, Nambour or Tewantin or visit us online at www.sunshinecoast.qld.gov.au. If correspondence includes personal information, please refer to Council's Privacy Policy at http://www.sunshinecoast.qld.gov.au . This email and any attachments are confidential and only for the use of the addressee. If you have received this email in error you are requested to notify the sender by return email or contact council on 1300 00 7272 and are prohibited from forwarding, printing, copying or using it in anyway, in whole or part. Please note that some council staff utilise Blackberry devices, which results in information being transmitted overseas prior to delivery of any communication to the device. In sending an email to Council you are agreeing that the content of your email may be transmitted overseas. Any views expressed in this email are the author's, except where the email makes it clear otherwise. The unauthorised publication of an email and any attachments generated for the official functions of council is strictly prohibited. Please note that council is subject to the Right to Information Act 2009 (Qld) and Information Privacy Act 2009 (Qld).
