Что означает это сообщение?

Osstudio · 2 Aug 2011

Не получалось взломать один ресурм, и с горя просканировал его сканером, и получил это:

Vulnerability description
ASP.Net uses encryption to hide sensitive data and protect it from tampering by the client. However, a vulnerability in the ASP.Net encryption implementation can allow an attacker to decrypt and tamper with this data. This vulnerability exists in all versions of ASP.NET. An attacker who exploited this vulnerability could view data, such as the View State, which was encrypted by the target server, or read data from files on the target server, such as web.config. This would allow the attacker to tamper with the contents of the data. By sending back the altered contents to an affected server, the attacker could observe the error codes returned by the server.

A workaround to prevent this vulnerability is to enable the <customErrors> feature of ASP.NET, and explicitly configure your applications to always return the same error page - regardless of the error encountered on the server. By mapping all error pages to a single error page, you prevent a hacker from distinguishing between the different types of errors that occur on a server.
This vulnerability affects /.
Discovered by: Scripting (ASP_NET_Oracle_Padding.script).
The impact of this vulnerability
An attacker who exploited this vulnerability could view data, such as the View State, which was encrypted by the target server, or read data from files on the target server, such as web.config. This would allow the attacker to tamper with the contents of the data. By sending back the altered contents to an affected server, the attacker could observe the error codes returned by the server.

Attack details
Acunetix detected this vulnerability by comparing the HTTP response status and body for two different requests (one request when the padding is incorrect and another one where the encrypted text is not valid). If the body AND/OR status are different, this vulnerability can be exploited.

First request:
Status code 302
Response body (first 500 bytes) <html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="/error500.asp?aspxerrorpath=/WebResource.axd">here</a>.</h2> </body></html> ...

Second request:
Status code 302
Response body (first 500 bytes) <html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="/error404.asp?aspxerrorpath=/WebResource.axd">here</a>.</h2> </body></html> ...

View HTTP headers
Request
GET /WebResource.axd HTTP/1.1
Cookie: srperc=77; ctr=ru; VMsi=2158263875; lng=ru; EFID=30E13AA3-1986-E3FA-2413-D78B0DBE9322; ASPSESSIONIDCQTDCSCC=FGGLNFOCFANHCKCIELJJBPNE; BigIPEnglishtown=oJwbjlr+SGOLAMsLJyardLtjJZP55Cir4P4V5tOVZjfajVCdxwIzTUn8bVYsZTml3i64u61KjZ/XLQI=; etctxtsess=ver=1.5|AEUAMQByADEAfgAtADEAfgBVAH4A; et_ctxtsoc=ver%3d1%7c%7e
Host: englishfirst.ru
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Accept: */*

Response
HTTP/1.1 302 Found
Date: Mon, 01 Aug 2011 19:06:37 GMT
Server: Microsoft-IIS/6.0
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR CONo CURi PSD OUR SAMo BUS ONL PHY FIN LOC"
X-Powered-By: ASP.NET
X-AspNet-Version: 4.0.30319
Location: /error404.asp?aspxerrorpath=/WebResource.axd
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 161
View HTML response
Launch the attack with HTTP Editor Retest alert(s) Mark this alert as a false positive
How to fix this vulnerability
Microsoft released a workaround to prevent this vulnerability from being exploited.

Enabling the Workaround on ASP.NET V1.0 to V3.5
If you are using ASP.NET 1.0, ASP.NET 1.1, ASP.NET 2.0, or ASP.NET 3.5 then you should follow the below steps to enable <customErrors> and map all errors to a single error page:

1) Edit your ASP.NET Application's root Web.Config file. If the file doesn't exist, then create one in the root directory of the application.
2) Create or modify the <customErrors> section of the web.config file to have the below settings:

<configuration>
<system.web>
<customErrors mode="On" defaultRedirect="~/error.html" />
</system.web>
</configuration>
3) You can then add an error.html file to your application that contains an appropriate error page of your choosing (containing whatever content you like). This file will be displayed anytime an error occurs within the web application.
Notes: The important things to note above is that customErrors is set to #on", and that all errors are handled by the defaultRedirect error page. There are not any per-status code error pages defined # which means that there are no <error> sub-elements within the <customErrors> section. This avoids an attacker being able to differentiate why an error occurred on the server, and prevents information disclosure.

Enabling the Workaround on ASP.NET V3.5 SP1 and ASP.NET 4.0
If you are using ASP.NET 3.5 SP1 or ASP.NET 4.0 then you should follow the below steps to enable <customErrors> and map all errors to a single error page:

1) Edit your ASP.NET Application's root Web.Config file. If the file doesn't exist, then create one in the root directory of the application.
2) Create or modify the <customErrors> section of the web.config file to have the below settings. Note the use of redirectMode="ResponseRewrite" with .NET 3.5 SP1 and .NET 4.0:

<configuration>
<system.web>
<customErrors mode="On" redirectMode="ResponseRewrite" defaultRedirect="~/error.aspx" />
</system.web>
</configuration>
3) You can then add an Error.aspx to your application that contains an appropriate error page of your choosing (containing whatever content you like). This file will be displayed anytime an error occurs within the web application.
4) We recommend adding the below code to the Page_Load() server event handler within the Error.aspx file to add a random, small sleep delay. This will help to further obfuscate errors.

Web references
Understanding the ASP.NET Vulnerability
Important: ASP.NET Security Vulnerability
Vulnerability in ASP.NET Could Allow Information Disclosure
How to check if your application is vulnerable to the ASP.NET Padding Oracle Vulnerability
Click to expand...

Суть текста понимаю, но не понимаю, как это использовать...

Osstudio · 2 Aug 2011

Вот перевод: http://habrahabr.ru/blogs/infosecurity/104511/
Так как это использовать?!

Osstudio · 4 Aug 2011

Блин, никто не знает что ли?!

Что означает это сообщение?

Osstudio Banned

Osstudio Banned

Osstudio Banned

Useful Searches

Что означает это сообщение?

Osstudio Banned

Osstudio Banned

Osstudio Banned