Massive ASP.Net Forms Authentication vulnerability

[Greg Hurlman]

http://sourceforge.net/mailarchive/forum.php?thread_id=5671607&forum_id=24754

This is, IMNSHO, the worst thing I've ever heard of.

Spread the word, test your sites, and send angry emails to Microsoft.

 

[Mike Bridge]

This seems to me like an absolutely massive security hole, but I see
it was posted to various security lists TWO WEEKS ago without any
response. What's Microsoft waiting for??

 

[Mike Bridge]

Hmm... this exploit affects URLs for localhost, but I can't seem to
get it to work on a regular URL....

-Mike

 

[Daniel Fisher\(lennybacon\)]

What about installing UrlScan.

I did that a year ago or so....

 

[Prodip Saha]

Greg,
I have confirmed this security hole on XP Professional with IE6. This is a
reminder to the companies- never solely rely on microsoft for their
application security.

Thanks,
Prodip