ASP.NET security flaw can bypass password

A security flaw in Microsoft’s ASP.NET technology could allow intruders to enter password-protected areas of a web site by altering a URL. A fix is not yet available, but Microsoft is offfering guidelines to help ASP.NET users secure their sites against intrusion attempts. The flaw exists only in ASP.NET, not ASP (Active Server Pages).

Microsoft reported : "This issue affects Web content owners who are running any version of ASP.NET on Microsoft Windows 2000, Windows 2000 Server, Windows XP Professional, and Windows Server 2003." Netcraft data finds that ASP.NET is currently on over 2.9 million active sites.

Read the complete story .