PT-2005-2641 · Microsoft · Asp.Net

Michal Zalewski · Published 2005-05-18 · Updated 2017-07-11 · CVE-2005-1664

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft ASP.NET version 1.x

Description The issue concerns the VIEWSTATE functionality, which allows remote attackers to conduct replay attacks. This can be used to apply a ViewState generated from one view to a different view, reuse ViewState information after the application's state has changed, or use the ViewState to conduct attacks or expose content to third parties.

Recommendations For Microsoft ASP.NET version 1.x, consider implementing proper validation and restrictions on ViewState usage to prevent replay attacks, such as using page-specific ViewState or implementing a mechanism to track and validate ViewState generation and usage.

Fix

Related Identifiers

CVE-2005-1664

Affected Products

Asp.Net

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2005-1664 · Security Note
• http://secunia.com/advisories/15241 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1664 · Note
• http://marc.info/?l=bugtraq&m=111532887612517&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20409 · Note
• http://marc.info/?l=bugtraq&m=111513127704270&w=2 · Note
• http://osvdb.org/16196 · Note
• http://scottonwriting.net/sowblog/posts/3747.aspx · Note