Microsoft .NET Framework Request Filtering Bypass Vulnerability

Bugtraq ID:	20753
Class:	Input Validation Error
CVE:	CVE-2006-7192
Remote:	Yes
Local:	No
Published:	Oct 26 2006 12:00AM
Updated:	Apr 23 2008 10:47PM
Credit:	ProCheckup and Ferruh T. Mavituna of Portcullis Computer Security Ltd. are credited with the discovery of this vulnerability.
Vulnerable:	Microsoft .NET Framework 2.0 HP Storage Management Appliance 2.1 + HP Storage Management Appliance III + HP Storage Management Appliance II + HP Storage Management Appliance I
Not Vulnerable:

Microsoft .NET Framework Request Filtering Bypass Vulnerability

Microsoft .NET framework is prone to a vulnerability that may permit an attacker to bypass content filtering.

The attacker can exploit this issue to perform multiple input-validation attacks such as cross-site scripting, SQL-injection, and HTML-injection; other attacks are also possible.

Microsoft .NET Framework Request Filtering Bypass Vulnerability

Attackers can exploit this issue via a browser.

Microsoft .NET Framework Request Filtering Bypass Vulnerability

Solution:
Microsoft has released security bulletin MS07-040 as well as updates to address this issue. Please see the references for details.


Microsoft .NET Framework 2.0

• Microsoft KB928365 - .NET Framework 2.0 SYSTEM.WEB.DLL and MSCOREE.DLL Security Update for Windows 2000, Windo
  http://www.microsoft.com/downloads/details.aspx?FamilyId=BA3CEB78-8E1B -4C38-ADFD-E8BC95AE548D


• Microsoft KB929916 - .NET Framework 2.0 SYSTEM.WEB.DLL Security Update for Windows Vista
  http://www.microsoft.com/downloads/details.aspx?FamilyId=CBC9F3CF-C3C3 -45C4-82E3-E11398BC2CD2

Microsoft .NET Framework Request Filtering Bypass Vulnerability

References:

• Vendor Home Page (Microsoft)
  
• Microsoft .NET request filtering bypass vulnerability ([email protected])
  
• Microsoft Security Bulletin MS07-040 (Microsoft)