Microsoft has warned users that hackers are exploiting the unpatched bug in ASP.Net to hijack encrypted Web sessions.
In a Monday update to a previously-published security advisory, Microsoft said that it was seeing "limited, active attacks at this time."
Symantec, which has a massive global network of sensors and honey trap-like systems to detect and capture exploits, said it had not seen any attacks, however.
The vulnerability exists in all versions of ASP.Net, the company's Web application framework used to craft millions of sites and applications, and lets attackers access Web applications with full administrator rights; decrypt session cookies or other encrypted data on a remote server; and access and snatch files from a site or Web application that relies on ASP.Net.
Microsoft acknowledged the flaw last Friday, the same day that a pair of researchers demonstrated how the "oracle padding" bug can be exploited by force-feeding cipher text to an ASP.Net application and noting the returned error messages it returns.
The company again promised to patch the vulnerability, but like last week, did not set a delivery date for the fix.
For full article please click here
No comments:
Post a Comment