PT-2006-4325 · Microsoft · Asp.Net+1

Jaswinder Hayre · Published 2006-10-10 · Updated 2018-10-18 · CVE-2006-3436

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework version 2.0

Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving ASP.NET controls that set the AutoPostBack property to true. This could enable an attacker to spoof content, disclose information, or take any action that the user could take on the affected web site. Exploitation of this issue requires user interaction.

Recommendations For Microsoft .NET Framework version 2.0, consider disabling ASP.NET controls that set the AutoPostBack property to true as a temporary workaround until a patch is available. Restrict access to sensitive areas of the web site to minimize the risk of exploitation. Avoid using the AutoPostBack property in ASP.NET controls until the issue is resolved.

Fix

Related Identifiers

CVE-2006-3436

Affected Products

.Net Framework

Asp.Net

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2006-3436 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3436 · Security Note
• http://secunia.com/advisories/22307 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-056 · Vendor Advisory
• http://securityfocus.com/archive/1/449179/100/0/threaded · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A377 · Note
• http://xforce.iss.net/xforce/xfdb/28658 · Note
• http://securityfocus.com/archive/1/archive/1/449179/100/0/threaded · Note
• http://kb.cert.org/vuls/id/455604 · Note
• http://vupen.com/english/advisories/2006/3976 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28658 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3436 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2006/MS06-056 · Note
• http://frsirt.com/english/advisories/2006/3976 · Note
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:377 · Note