Hackers who discovered the vulnerability estimate that 25% of all sites are subject to attacks due to the problem.
Microsoft warned on Friday (20/09) that a critical flaw in ASP.Net - programming environment on Windows Servers - could be used by hackers to break into encrypted web pages and steal data such as user names and passwords.
The vulnerability was made public that same day, shortly before the announcement of the company, when two researchers who discovered the problem, show how to exploit it at a security conference held in Buenos Aires, Argentina.
According to the statement of the Redmond company, the flaw affects all versions of ASP.Net. Therefore, a correction must be provided for all operating systems still supported, the Windows XP Service Pack 3 (SP3) and Server 2003 to Windows 7 and Server 2008 R2. Other products such as IIS and SharePoint will also be updated.
The hackers responsible for the establishment, Rizzo and Duong, said the attacks that exploit the flaw can access Web applications with administrative priority, resulting from "loss of sensitive data to the complete destruction of the system." They estimate that 25% of all sites use the ASP.Net.
While the correction is not
Although Microsoft has said that a fix is on the way, she did not disclose a timeline. Meanwhile, developers suggests a stopgap measure:
"You can prevent this problem by enabling the use of customError ASP.Net, and set it to always return the same error page - regardless of fault found on the server," wrote Scott Guthrie, some teams responsible for business development, including that runs the ASP.Net. "By directing all error pages to one place, you prevent a hacker to distinguish between the different errors that occurred."
The director of security operations at nCircle Security company confirmed that the vulnerability is "troubling."
"As for public services, people will be afraid to attacks that can access any document. For example, file 'web.config', which are contained in the traditional username / password ".
To help developers, Microsoft has published a script in Visual Basic can detect vulnerability in ASP.Net applications, and provide a unique forum for questions related to the problem.
