On Wed, Sep 29, 2010 at 11:27 AM, Dylan Tusler <[email protected]> wrote: > Right, but all the vulnerability walkthroughs I saw involved using the > vulnerability to get super-user status and then using that status to do > other nefarious things. > > If you don't have user authentication of any kind, is there any threat? If > nobody can login to my site, can the site's web.config still be accessed, > for example.
I think it's safe to say if you are *never* attempting to decrypt something sent from the client, then you aren't at risk (I'd need to read through the entire vulnerability details to confirm this though, which I haven't done). But, it's hard to be sure of this, depending on what you are doing. ASP.NET may be doing it without your knowledge. The fix is so trivial (don't display any error info to the client), and generally good practice anyway, you should just do it. > Dylan. -- silky http://dnoondt.wordpress.com/ "Every morning when I wake up, I experience an exquisite joy — the joy of being this signature."
