Massive ASP.Net Forms Authentication vulnerability

[Greg Hurlman]

[url]http://sourceforge.net/mailarchive/forum.php?thread_id=5671607&forum_id=24754[/url]

This is, IMNSHO, the worst thing I've ever heard of.

Spread the word, test your sites, and send angry emails to Microsoft.
---
Greg Hurlman
ghurlman*AT*squaretwo*DOT*net
[url]http://blogs.squaretwo.net[/url]

[Mike Bridge]

This seems to me like an absolutely massive security hole, but I see
it was posted to various security lists TWO WEEKS ago without any
response. What's Microsoft waiting for??




On Thu, 30 Sep 2004 06:17:02 -0700, Greg Hurlman
<ghurlman*AT*squaretwo*DOT*net> wrote:

>[url]http://sourceforge.net/mailarchive/forum.php?thread_id=5671607&forum_id=24754[/url]
>
>This is, IMNSHO, the worst thing I've ever heard of.
>
>Spread the word, test your sites, and send angry emails to Microsoft.
>---
>Greg Hurlman
>ghurlman*AT*squaretwo*DOT*net
>[url]http://blogs.squaretwo.net[/url]

[Mike Bridge]

Hmm... this exploit affects URLs for localhost, but I can't seem to
get it to work on a regular URL....

-Mike

On Thu, 30 Sep 2004 06:17:02 -0700, Greg Hurlman
<ghurlman*AT*squaretwo*DOT*net> wrote:

>[url]http://sourceforge.net/mailarchive/forum.php?thread_id=5671607&forum_id=24754[/url]
>
>This is, IMNSHO, the worst thing I've ever heard of.
>
>Spread the word, test your sites, and send angry emails to Microsoft.
>---
>Greg Hurlman
>ghurlman*AT*squaretwo*DOT*net
>[url]http://blogs.squaretwo.net[/url]

[Daniel Fisher\(lennybacon\)]

What about installing UrlScan.

I did that a year ago or so....

--
Daniel Fisher(lennybacon)
MCP C# ASP.NET
Blog: [url]http://www.lennybacon.com/[/url]




"Greg Hurlman" <ghurlman*AT*squaretwo*DOT*net> wrote in message
news:7FAE1C11-2A1D-46E4-83C9-441BE8B2944E@microsoft.com...

> [url]http://sourceforge.net/mailarchive/forum.php?thread_id=5671607&forum_id=24754[/url]
>
> This is, IMNSHO, the worst thing I've ever heard of.
>
> Spread the word, test your sites, and send angry emails to Microsoft.
> ---
> Greg Hurlman
> ghurlman*AT*squaretwo*DOT*net
> [url]http://blogs.squaretwo.net[/url]

[Prodip Saha]

Greg,
I have confirmed this security hole on XP Professional with IE6. This is a
reminder to the companies- never solely rely on microsoft for their
application security.

Thanks,
Prodip

"Greg Hurlman" <ghurlman*AT*squaretwo*DOT*net> wrote in message
news:7FAE1C11-2A1D-46E4-83C9-441BE8B2944E@microsoft.com...

>

[url]http://sourceforge.net/mailarchive/forum.php?thread_id=5671607&forum_id=24754[/url]

>
> This is, IMNSHO, the worst thing I've ever heard of.
>
> Spread the word, test your sites, and send angry emails to Microsoft.
> ---
> Greg Hurlman
> ghurlman*AT*squaretwo*DOT*net
> [url]http://blogs.squaretwo.net[/url]