Microsoft Security Advisory Released - 'Padding Oracle' ASP.NET Vulnerability

http://www.microsoft.com/technet/security/advisory/2416728.mspx

Microsoft is investigating a new public report of a vulnerability [CVE-2010-3332] in ASP.NET. An attacker who exploited this vulnerability could view data, such as the View State, which was encrypted by the target server, or read data from files on the target server, such as web.config. This would allow the attacker to tamper with the contents of the data. By sending back the altered contents to an affected server, the attacker could observe the error codes returned by the server. We are not aware of attacks that try to use the reported vulnerabilities or of customer impact at this time.

-----------------------------------------------------------------------------------------

'Padding Oracle' Crypto Attack Affects Millions of ASP.NET Apps
http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310

Demo of ASP.NET Padding Oracle Attack (POET vs ASP.NET)
http://threatpost.com/en_us/blogs/demo-aspnet-padding-oracle-attack-091710

------------------------------------------------------------------------------------------

Padding Oracle Exploit Tool (POET)
http://netifera.com/research/