PT-2005-2642 · Microsoft · Asp.Net

Michal Zalewski · Publicado 2005-05-18 · Atualizado 2017-07-11 · CVE-2005-1665

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft ASP.NET version 1.x

Description The issue concerns the VIEWSTATE functionality in Microsoft ASP.NET. When this functionality is not cryptographically signed, it allows remote attackers to cause a denial of service by consuming CPU resources via deeply nested markup.

Recommendations For Microsoft ASP.NET version 1.x, consider implementing cryptographic signing for the VIEWSTATE functionality to prevent denial of service attacks. As a temporary workaround, consider restricting the depth of nested markup to minimize the risk of CPU consumption.

Correção

Identificadores relacionados

CVE-2005-1665

Produtos afetados

Asp.Net

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2005-1665 · Nota de Segurança
• http://scottonwriting.net/sowblog/posts/3747.aspx · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20408 · Nota
• http://secunia.com/advisories/15241 · Aviso do Fabricante
• http://osvdb.org/16195 · Nota
• http://marc.info/?l=bugtraq&m=111513127704270&w=2 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1665 · Nota