CIA RESEARCH

Alerts

[CIA-1060-Alert] ASP.NET Application Information Disclosure

Summary:

A vulnerability in ASP.NET allows a remote attacker to obtain unauthorized access to objects in the application folder.

Technical Details:

Microsoft .NET framework 2.0 (ASP.NET) allows a remote attacker to bypass access control restrictions by using particular URLs to obtain access to objects in the application folder. The attacker must specify the name of the object correctly in order to obtain access.
While details of the vulnerability are not publicly available, additional information can be found in the Microsoft Security Advisory MS06-033. Sites running affected versions of ASP.NET are encouraged to following the security recommendations in the Microsoft advisory.

Solution:

Apply the security fix discussed in MS06-033
www.microsoft.com/technet/security/bulletin/ms06-033.mspx

CVE Reference:

CVE-2006-1300

SecurityTracker Number(s):

1016465

Vendor URL:

Microsoft

About the Cenzic CIA Team:

Cenzic Intelligent Analysis (CIA) is Cenzic's research arm that focuses on continuous research for application vulnerabilities. Industry Research, Vulnerability assessment, penetration testing, and security testing - that's what Cenzic Intelligent Analysis Research is all about. Cenzic has dedicated experts whose sole job is to perform ongoing research to find not only common vulnerabilities but also vulnerabilities found in customer applications and make them available to our customers and to the community at large.

About Cenzic:

Cenzic provides Hailstorm® the revolutionary enterprise software suite for automated application security assessment and compliance that allows corporations and government organizations to dramatically improve the security of commercial and custom applications. Hailstorm enables security experts, QA professionals, and developers to work together to assess, analyze, and remediate applications for security vulnerabilities, and verify compliance with security policies. Benefits include reduced security risk and liability, lower development and testing costs, and faster time-to-market. Cenzic's customers are currently in the financial services and e-marketplaces sectors. For more information visit www.cenzic.com or call 1-866-4-CENZIC