[security-alerts] FW: [SA22307] Microsoft .NET Framework Cross-Site Scripting Vulnerability

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> TITLE:
> Microsoft .NET Framework Cross-Site Scripting Vulnerability
> 
> SECUNIA ADVISORY ID:
> SA22307
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/22307/
> 
> CRITICAL:
> Less critical
> 
> IMPACT:
> Cross Site Scripting
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> Microsoft .NET Framework 2.x
> http://secunia.com/product/6456/
> 
> DESCRIPTION:
> A vulnerability has been reported in ASP.NET 2.0, which can be
> exploited by malicious people to conduct cross-site scripting
> attacks.
> 
> Certain input is not properly sanitised before being returned to the
> user. This can be exploited to execute arbitrary code in a users
> browser-session associated with a vulnerable website.
> 
> Successful exploitation requires that the "AutoPostBack" feature is
> set to "true" (not the default setting).
> 
> SOLUTION:
> Apply patch:
> 
> Microsoft .NET Framework 2.0:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=34C37
> 5AA-2F54-4416-B1FC-B73378492AA6
> 
> PROVIDED AND/OR DISCOVERED BY:
> The vendor credits Jaswinder Hayre.
> 
> ORIGINAL ADVISORY:
> MS06-056 (KB922770):
> http://www.microsoft.com/technet/security/Bulletin/MS06-056.mspx
>