PT-2005-2642 · Microsoft · Asp.Net

Michal Zalewski · Published 2005-05-18 · Updated 2017-07-11 · CVE-2005-1665

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft ASP.NET version 1.x

Description The issue concerns the VIEWSTATE functionality in Microsoft ASP.NET. When this functionality is not cryptographically signed, it allows remote attackers to cause a denial of service by consuming CPU resources via deeply nested markup.

Recommendations For Microsoft ASP.NET version 1.x, consider implementing cryptographic signing for the VIEWSTATE functionality to prevent denial of service attacks. As a temporary workaround, consider restricting the depth of nested markup to minimize the risk of CPU consumption.

Fix

Related Identifiers

CVE-2005-1665

Affected Products

Asp.Net

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2005-1665 · Security Note
• http://scottonwriting.net/sowblog/posts/3747.aspx · Vendor Advisory
• http://secunia.com/advisories/15241 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20408 · Note
• http://osvdb.org/16195 · Note
• http://marc.info/?l=bugtraq&m=111513127704270&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1665 · Note