On Wed, Sep 29, 2010 at 12:15 PM, David Connors <[email protected]> wrote: > On 29 September 2010 11:07, silky <[email protected]> wrote: > > > > It affects everyone using .NET. > > Everyone using ASP.NET who uses session state/view state etc. If you don't > use these things then there is no impact for you.
Sorry but I think it's important to note this is .NET-Wide. The problem is *padding oracle*; it's just that ASP.NET has bad implementations. As I suggested last week, it's an attack against any generic encryption system that attempts to decrypt untrusted data (i.e. no HMAC). It happens that .NET reports *specifically* regarding the padding information, and thus any .NET process doing this type of encryption (ASP.NET's ViewState/FormsAuth/Whatever), reports it directly back (if you let it) and thus you can make inferences and determine the key. My guess from reading the PDF I sent through is that they gain access to the Web.config by manipulating WebResource somehow (they imply as much I think). So, of course it also follows that you should *not* store anything of any importance in the web.config. This is not so hard. Just load the important stuff from a file that is not in the web root. I think this is even possible with one of the MS add-ins (configuration manager or something, I forget its name sorry). > Though > this: http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx > says: > > What does the vulnerability enable? > An attacker using this vulnerability can request and download files within > an ASP.NET Application like the web.config file (which often contains > sensitive data). > At attacker exploiting this vulnerability can also decrypt data sent to the > client in an encrypted state (like ViewState data within a page). > > Has anyone read any more specifics on that part? > David. > -- > David Connors | [email protected] | www.codify.com > Software Engineer > Codify Pty Ltd > Phone: +61 (7) 3210 6268 | Facsimile: +61 (7) 3210 6269 | Mobile: +61 417 > 189 363 > V-Card: https://www.codify.com/cards/davidconnors > Address Info: https://www.codify.com/contact -- silky http://dnoondt.wordpress.com/ "Every morning when I wake up, I experience an exquisite joy — the joy of being this signature."
