Ismet Dumlupinar posted on April 04, 2010 09:24
I already notified registered users of this website, but i want to also warn anonymous visitors about a very critical security hole within ASP.NET.
Last week, some guys demonstrated an action that could help a hacker to attack websites under ASP.NET, regardless of which version being used.
Those guys, first browsing a non-existing page to see error page, and somehow they are getting necessary inputs from there to generate authentication tickets.
This is just like well known Oracle Padding issue. And those guys will probably publish and distribute tools find vulnerable sites and do some dirty tasks.
Sadly, no patch from Microsoft available yet, but can always apply a workaround.
So, please go ahead and patch your servers, websites and whatever insecure file you have.
Some useful posts for temporary workaround.
Oracle Padding Now Affects DotNetNuke