Microsoft ASP.NET Security Vulnerability: "padding oracle"

Microsoft has released a security advisory about a vulnerability in ASP.NET. A security patch is already available here.

Below are some details on how the vulnerability works:

“To understand how this vulnerability works, you need to know about cryptographic oracles. An oracle in the context of cryptography is a system which provides hints as you ask it questions. In this case, there is a vulnerability in ASP.NET which acts as a padding oracle. This allows an attacker to send cipher text to the web server and learn if it was decrypted properly by examining which error code was returned by the web server. By making many such requests (and watching what errors are returned) the attacker can learn enough to successfully decrypt the rest of the cipher text.” (quoted from Scott Guthrie’s blog)

• asp-net
• security