To view the full article in its entirety, please visit eWeek: Microsoft Warns of ASP.NET Attacks

Microsoft is warning users it has seen "limited attacks" targeting an ASP.NET vulnerability that could potentially affect many Web applications.

The issue, which was demonstrated by security researchers Juliano Rizzo and Thai Duong, is due to ASP.NET’s use of encryption padding, which provides information in error messages that can be used by an attacker to potentially read and alter encrypted data. Duong and Rizzo designed a tool to exploit the vulnerability, which they presented at the Ekoparty security conference in Buenos Aires, Argentina, last week.

“An attacker who successfully exploited this vulnerability would be able to read data, such as the View State, which was encrypted by the server,” Microsoft warned in an advisory. “This data may also be tampered with by the attacker…[who] could send this data back to the server and observe the error codes returned by the server. By observing these error codes, an attacker could gain enough information to decrypt and tamper with the encrypted data.”