SID 15985
Msg
"SPECIFIC-THREATS Microsoft ASP.NET canonicalization exploit attempt"
Summary
This event is generated when an attempt is made to exploit a known vulnerability in asp.net.
Classtype
attempted-user
Impact
Denial of Service. Information disclosure. Loss of integrity.
Detailed Information
The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability."
Affected Systems
- Microsoft asp.net
Ease Of Attack
Medium.
False Positives
None known.
False Negatives
None known.
Corrective Action
Upgrade to the latest non-affected version of the software.
Apply the appropriate vendor supplied patches.
Contributors
- Sourcefire Vulnerability Research Team
- This document was generated from data supplied by the National Vulnerability Database. A product of the National Institute of Standards and Technology.
- For more information see http://nvd.nist.gov/
