Microsoft ASP.NET: Critical Access Risk from URL Processing Flaw

Updated: A glitch in the platform's processing of URLs could allow intruders to access password-protected sections of a Web site simply by altering a URL. . . . Updated: A glitch in the platform's processing of URLs could allow intruders to access password-protected sections of a Web site simply by altering a URL.

Microsoft Corp. is investigating a reported security flaw in its ASP.NET technology that could allow intruders to access password-protected sections of a Web site simply by altering a URL.

The hole involves a glitch in ASP.NET's processing of URLs, a process known as canonicalization. According to an advisory posted Tuesday on Microsoft's Web site, "an attacker can send specially crafted requests to the server and view secured content without providing the proper credentials."

The link for this article located at Simone Kaplan is no longer available.