PT-2005-2641 · Microsoft · Asp.Net

Michal Zalewski · Publicado 2005-05-18 · Atualizado 2017-07-11 · CVE-2005-1664

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft ASP.NET version 1.x

Description The issue concerns the VIEWSTATE functionality, which allows remote attackers to conduct replay attacks. This can be used to apply a ViewState generated from one view to a different view, reuse ViewState information after the application's state has changed, or use the ViewState to conduct attacks or expose content to third parties.

Recommendations For Microsoft ASP.NET version 1.x, consider implementing proper validation and restrictions on ViewState usage to prevent replay attacks, such as using page-specific ViewState or implementing a mechanism to track and validate ViewState generation and usage.

Correção

Identificadores relacionados

CVE-2005-1664

Produtos afetados

Asp.Net

Referências · 8

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1664 · Nota
• http://marc.info/?l=bugtraq&m=111532887612517&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20409 · Nota
• http://marc.info/?l=bugtraq&m=111513127704270&w=2 · Nota
• http://osvdb.org/16196 · Nota
• http://scottonwriting.net/sowblog/posts/3747.aspx · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1664 · Nota de Segurança
• http://secunia.com/advisories/15241 · Aviso do Fabricante