{"id":2246,"date":"2010-09-25T07:15:09","date_gmt":"2010-09-25T07:15:09","guid":{"rendered":"http:\/\/blog.resellerclub.com\/?p=2246"},"modified":"2025-10-24T14:05:59","modified_gmt":"2025-10-24T14:05:59","slug":"how-to-secure-your-site-against-a-vulnerability-in-asp-net-that-could-allow-information-disclosure","status":"publish","type":"post","link":"https:\/\/www.resellerclub.com\/blog\/how-to-secure-your-site-against-a-vulnerability-in-asp-net-that-could-allow-information-disclosure\/","title":{"rendered":"How to secure your site against a vulnerability in ASP.NET that could allow Information Disclosure."},"content":{"rendered":"

A few days ago Microsoft released a Security Advisory (http:\/\/www.microsoft.com\/technet\/security\/advisory\/2416728.mspx) about a vulnerability which affects all versions of ASP.NET. This vulnerability known as Padding Oracle exploits the way an ASP.NET application handles encrypted data. ASP.NET encrypts data to prevent an application from tampering with it. Because of this vulnerability, an attacker can send data to a site and analyze the error response which provides a lot of information enabling the attacker to break the ASP.NET’s encryption in a matter of hours or minutes. An attacker then would be able to read a vulnerable application’s files and tamper with the data contained in them.<\/span><\/p>\n

Workaround <\/strong><\/span><\/p>\n

A workaround that you can use against this vulnerability is to enable <customErrors> mode in the web.config file of your application, and explicitly configure your applications to always return the same error page – regardless of the error encountered on the server. By mapping all error pages to a single error page, you prevent a hacker from distinguishing between the different types of errors that occur on a server.<\/span><\/p>\n

Enabling the Workaround on ASP.NET V1.0 to V3.5<\/strong><\/span><\/p>\n

If you are using ASP.NET 1.0, ASP.NET 1.1, ASP.NET 2.0, or ASP.NET 3.5 then you should follow the below steps to enable <customErrors> and map all errors to a single error page:<\/span><\/p>\n

\n
    \n
  • Edit your ASP.NET Application\u2019s root Web.Config file.\u00a0 If the file doesn\u2019t exist, then create one in the root directory of the application.<\/li>\n
  • Create or modify the <customErrors> section of the web.config file to have the below settings:<\/li>\n<\/ul>\n

    ++<\/span><\/configuration><\/p>\n

    ++<\/span><system.web><\/p>\n

    ++<\/span><customErrors mode=”On” defaultRedirect=”~\/error.html” \/><\/p>\n

    ++<\/span><\/system.web><\/p>\n

    ++<\/span><\/configuration><\/p>\n

      \n
    • You can then add an error.html file to your application that contains an appropriate error page of your choice (containing whatever content you like).\u00a0 This file will be displayed anytime an error occurs within the web application.<\/li>\n<\/ul>\n<\/div>\n


      \n<\/span><\/p>\n

      Enabling the Workaround on ASP.NET V3.5 SP1 and ASP.NET 4.0<\/strong><\/span><\/p>\n

      If you are using ASP.NET 3.5 SP1 or ASP.NET 4.0 then you should follow the below steps to enable <customErrors> and map all errors to a single error page:<\/span><\/p>\n

      \n
        \n
      • Edit your ASP.NET Application\u2019s root Web.Config file.\u00a0 If the file doesn\u2019t exist, then create one in the root directory of the application.<\/li>\n
      • Create or modify the <customErrors> section of the web.config file to have the below settings.\u00a0 Note the use of redirectMode=\u201dResponseRewrite\u201d with .NET 3.5 SP1 and .NET 4.0:<\/li>\n<\/ul>\n

        ++<\/span><configuration><\/p>\n

        ++<\/span><system.web><\/p>\n

        ++<\/span><customErrors mode=”On” redirectMode=”ResponseRewrite”
        \n++<\/span>defaultRedirect=”~\/error.aspx” \/><\/p>\n

        ++<\/span><\/system.web><\/p>\n

        ++<\/span><\/configuration><\/p>\n

          \n
        • You can then add an Error.aspx to your application that contains an appropriate error page of your choice (containing whatever content you like).\u00a0 This file will be displayed anytime an error occurs within the web application.<\/li>\n<\/ul>\n<\/div>\n


          \n<\/span><\/p>\n

          How to Verify if the Workaround is Enabled<\/strong><\/span><\/p>\n

          Once you have applied the above workaround, you can test to make sure the <customErrors> section is correctly configured by requesting a URL like this from your site: http:\/\/mysite.com\/pagethatdoesnotexist.aspx<\/span><\/p>\n

          If you see the custom error page appear (because the file you requested doesn\u2019t exist) then your configuration has been setup correctly.\u00a0 If you see a standard ASP.NET error then it is likely that you missed one of the steps above.<\/span><\/p>\n

          Microsoft is currently working on a patch to fix this vulnerability. Once released, we will apply this on all of our Windows servers. This workaround will not be needed after that.<\/span><\/p>\n

          We are looking for you to suggest what topics you would like to see on this blog. We will try our best to make sure the information that is critical to you is always available here.<\/em><\/span><\/p>\n

          \n\t\t\t
          \n\t\t\t <\/div><\/div>\n\t\t