OSVDB ID: 10670

Title: Microsoft ASP.NET Forms .aspx File Authentication Bypass

Info

Disclosure
Sep 14, 2004

Discovery
Unknown

Dates

Exploit
Sep 14, 2004

Solution
Unknown

Description

 ASP.NET contains a flaw that may allow a malicious user to bypass authentication. The issue is triggered when a specially crafted URL which takes advantage of character handling is used to directly access a file which otherwise requires authentication. It is possible that the flaw may allow unauthorized file access resulting in a loss of confidentiality.

Classification

 Location: Remote/Network Access Required
Attack Type: Information Disclosure, Input Manipulation
Impact: Loss of Confidentiality
Exploit: Exploit Available
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

 Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

Products

Microsoft Corporation

ASP.NET

 1.0
1.1

References

Credit
  • Toby Beaumont - tobyBrand New Doo Doocreator.co.uk -


Direct URL: http://osvdb.org/36218