Description
The __VIEWSTATE functionality in Microsoft ASP.NET 1.x allows remote attackers to conduct replay attacks to (1) apply a ViewState generated from one view to a different view, (2) reuse ViewState information after the application's state has changed, or (3) use the ViewState to conduct attacks or expose content to third parties.
References
- 20050503 ASP.NET __VIEWSTATE crypto validation prone to replay attacks mailing-list
- http://scottonwriting.net/sowblog/posts/3747.aspx
- 20050505 Re: ASP.NET __VIEWSTATE crypto validation prone to replay attacks mailing-list
- ms-aspnet-viewstate-replay(20409) vdb-entry
- 15241 third-party-advisory
- 16196 vdb-entry