Invalid Viewstate Since Oracle Padding Vulnerability Security Patch

Creating Custom Httphandler In Web.config: Am I At Risk Of Exposing A 'Padding Oracle' Vulnerability?

Oct 29, 2010

Considering the recent ASP.NET vulnerability, what should I look for in my httphandlers that would cause such a Padding Oracle vulnerability?

Asked in another way... what did MSFT do wrong and what did they fix in their handlers?

View 2 Replies

Security :: Getting Error/Padding Is Invalid And Cannot Be Removed.

Jan 15, 2010

I have all application errors sent to my email. I keep getting this:

mysite.com/webresource.axd?d=yacsx7hz0irzn_i7ifr3morrek9u6srdkqxsjvpn3mw1&t=633598204507656250
Padding is invalid and cannot be removed.

[Exception Info]

Stack Trace: at System.Security.Cryptography.RijndaelManagedTransform.DecryptData(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount, Byte[]& outputBuffer, Int32 outputOffset, PaddingMode paddingMode, Boolean fLast)
at System.Security.Cryptography.RijndaelManagedTransform.TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount)
at System.Security.Cryptography.CryptoStream.FlushFinalBlock()
[code]....

i googled and read to add machineKey in my web.config <system.web> which i did:
<machineKey validationKey='0EFA95136AEA44850D5CEDDF0CC7502B1A009.....' decryptionKey='E88EB13ADB2C3D395193AA71DBB1E...' validation='SHA1'/>

and added
<pages masterPageFile enableViewStateMac="true" viewStateEncryptionMode="Auto"> to my masterpage.But i keep getting that error.

View 2 Replies

Security :: Padding Is Invalid And Cannot Be Removed/unable To Solve It?

Feb 23, 2010

Following is the error log captured:-

The error description is as follows :
Source: mscorlib

Message: Padding is invalid and cannot be removed.
Stack Trace:at System.Security.Cryptography.RijndaelManagedTransform.DecryptData(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount, Byte[]& outputBuffer, Int32 outputOffset, PaddingMode paddingMode, Boolean fLast)

[code]....
This issue is occuring on and off and I am unable to reproduce it at my end.

View 5 Replies

Security :: Riijandael Method Error/ Padding Is Invalid And Cannot Be Removed

Apr 15, 2010

I am using following code to encrypt and decrypt files. It works fine in windows application but shows an error in asp.net class. It's using Riijandael method.

Error : padding is invalid and cannot be removed

Code:Public Sub EncryptOrDecryptFile(ByVal strInputFile As String, _
ByVal strOutputFile As String, _
) [code]....

View 5 Replies

Invalid Padding On 2.0 Cookie, MVC Looks Ok?

Apr 5, 2010

We have a cookie management library that writes a cookie containing some sensitive information, encrypted with Rijndael. The cookie encrypts and decrypts fine in unit tests (using Moq), works fine for MVC web applications, but when called from an ASP.net 2.0 website, the cookie cannot be decrypted. "Padding is invalid and cannot be removed."

We are sure that the cookie value is valid because we tested it 10,000 times with random data in a unit test. There is something about what ASP.NET 2.0 does when it reads and writes the cookie that causes trouble.

View 1 Replies

C# - What Else Can Cause 'Padding Is Invalid And Cannot Be Removed" Exception With WebResource.axd

May 7, 2010

Recently, a couple of my applications have started throwing exceptions with the message Padding is invalid and cannot be removed intermitently

My applications already have a machineKey specified in the web.config as suggested in this thread

The applications are deployed to a single Windows 2003 server running IIS6.

View 1 Replies

Adding MachineKey To Web.config On Web-farm Sites / Padding Is Invalid And Cannot Be Removed

Oct 4, 2010

We (out IT partner really) recently changed some DNS for a web farmed site we have so that the two production server have round-robin DNS switching between the two. Prior to this switch we didn't really have problems with WebResource.axd files. Since the switch, when we hit the live public URL, we get an error:

CryptographicException

Padding is invalid and cannot be removed.

When we hit the specific servers themselves, they load fine. I've researched the issue and it seems since they're sharing assets between two servers, we need to have a consistent machineKey in the web.config for each server so they can encrypt and decrypt consistently between the two. My questions are:

Can I generate a machineKey via a tool on the server, or do I need to write code to do this?

Do I just need to add the machineKey to the web.config on each server or do you think I'll need to do anything else to make the two server work together? (Both web.config's currently do not have a machineKey)

View 2 Replies

RedirectMode In Security Vulnerability?

Sep 20, 2010

In Scott Guthries blog on the ASP.NET Security vulnerability noted here he says that for ASP.NET 3.5 SP1+ the following attribute should be set in the custom errors section

redirectMode="ResponseRewrite"

What is the significance of this in relation to the vulnerability and why only 3.5 SP1 and above?

View 2 Replies

How Serious Is This New Security Vulnerability And How To Workaround It

Sep 15, 2010

I've just read on the net about a newly discovered security vulnerability in ASP.NET. You can read the details here. The problem lies in the way that ASP.NET implements the AES encryption algorithm to protect the integrity of the cookies these applications generate to store information during user sessions.This is a bit vague, but here is a more frightening part: The first stage of the attack takes a few thousand requests, but once it succeeds and the attacker gets the secret keys, it's totally stealthy.The cryptographic knowledge required is very basic.

All in all, I'm not familiar enough with the security/cryptograpy subject to know if this is really that serious.So, should all ASP.NET developers fear this technique that can own any ASP.NET website in seconds or what?How does this issue affect the average ASP.NET developer? Does it affect us at all?
In real life, what are the consequences of this vulnerability? And, finally: is there some workaround that prevents this vulnerability?EDIT: I'd like to summarize the responses I got so far.So, this is basically a "padding oracle" type of attack. @Sri provided a great explanation about what does this type of attack mean. Here is a shocking video about the issue!About the seriousness of this vulnerability: Yes, it is indeed serious. It lets the attacker to get to know the machine key of an application. Thus, he can do some very unwanted things.

In posession of the app's machine key, the attacker can decrypt authentication cookies.
Even worse than that, he can generate authentication cookies with the name of any user. Thus, he can appear as anyone on the site. The application is unable to differentiate between you or the hacker who generated an authentication cookie with your name for himself.It also lets him to decrypt (and also generate) session cookies, although this is not as dangerous as the previous one.Not so serious: He can decrypt the encrypted ViewState of pages. (If you use ViewState to store confidental data, you shouldn't do this anyways!)Quite unexpected: With the knowledge of the machine key, the attacker can download any arbitrary file from your web application, even those that normally can't be downloaded! (Including Web.Config, etc.)

Here is a bunch of good practices I got that don't solve the issue but help improve the general security of a web application.You can encrypt sensitive data with Protected Configuration Use HTTP Only cookies Prevent DoS attacksNow, let's focus on this issue.Scott Guthrie published an entry about it on his blogScottGu's FAQ blog post about the vulnerabilityScottGu's update on the vulnerabilityMicrosoft has a security advisory about itUnderstanding the vulnerabilityAdditional information about the vulnerabilityhe solutionEnable customErrors and make a single error page to which all errors are redirected. Yes, even 404s.

ScottGu said that differentiating between 404s and 500s are essential for this attack.) Also, into your Application_Error or Error.aspx put some code that makes a random delay. (Generate a random number, and use Thread.Sleep to sleep for that long.) This will make it impossible for the attacker to decide what exactly happened on your server.Some people recommended switching back to 3DES. In theory, if you don't use AES, you don't encounter the security weakness in the AES implementation. As it turns out, this is not recommended at all.Some other

View 12 Replies

Security - Is The Cryptographic Vulnerability Work Around A BIG LIE

Sep 23, 2010

This question is somewhat of a follow up to How serious is this new ASP.NET security vulnerability and how can I workaround it? So if my question seems to be broken read over this question and its accepted solution first and then take that into the context of my question.Can someone explain why returning the same error page and same status code for custom errors matters? I find this to be immaterial especially if this is advocated as part of the work around to it.Isn't it just as easy for the script/application to execute this attack and not specifically care whether or not it gets a http status code and more on the outcome? Ie doing this 4000 times you get redirected to an error page where on 4001 you stay on the same page because it didn't invalidate the padding?

I see why adding the delay to the error page is somewhat relevant but doesn't this also just add another layer to fool the script into thinking the site is an invalid target?What could be done to prevent this if the script takes into account that since the site is asp.net it's running the AES encryption that it ignores the timing of error pages and watches the redirection or lack of redirection as the response vector? If a script does this will that mean there's NO WAY to stop it?Edit: I accept the timing attack reduction but the error page part is what really seems bogus. This attack vector puts their data into viewstate. There's only 2 cases. Pass. Fail.

Either Fail, they're on a page and the viewstate does not contain their data. No matter what you do here there is no way to remove the fail case because the page just will never contain their inserted data unless they successfully cracked the key. This is why I can't justify the custom errors usage having ANY EFFECT AT ALL.Or Pass, they're on a page and the viewstate contains their inserted data.Summary of this vulnerability

The cipher key from the WebResoure.axd / ScriptResource.axd is taken and the first guess of the validation key is used to generate a value of potential key with the ciphered text.This value is passed to the WebResource.axd / ScriptResource.axd at this point if the decryption key was guessed correctly their response will be accepted but since the data is garbage that it's looking for the WebResource.axd / ScriptResource.axd will return a 404 error.If the decryption key was not successfully guessed it will get a 500 error for the padding invalid exception. At this point the attack application knows to increment the potential decryption key value and try again repeating until it finds the first successful 404 from the WebResource.axd / ScriptResource.axd

View 4 Replies

Configuration :: .NET Windows 2003 Security Patch And Impersonation. IIS 6

Jun 30, 2010

I have an ASP.NET site that uses impersonation. As the impersonated user I use a domain user (not a local machine user). The site is hosted in IIS 6 running on Windows 2003. In IIS 6 for directory security windows authentication is ticked.The site has been running now for about 6 months without any problem. However since about a week back the site has started spuring up really wierd errors. For one, users cannot access the site anymore. When accessing a windows authentication dialog box appears having the user to enter the credentials. However these credentials are not accepted and the standard unauthorized page is displayed

View 7 Replies

Wcf - Security Vulnerability (Cryptographic Oracles) And Web Services?

Sep 20, 2010

Just reading about this ASP.NET security vurnerability. Just wondering if this could be used to attack a WCF service hosted under IIS to get to its web.config or if its a pure ASP.NET vurnerability

View 3 Replies

Security Vulnerability (Cryptographic Oracles) - Why Html Redirect For Pre 3.5 SP1

Sep 21, 2010

Why does the recent ASP.NET security vurnerability specify an html error page to redirect to pre ASP.NET 3.5 SP1 but an aspx page for later versions?

View 1 Replies

Change The User Password While Retrieving Current Password Error - Padding Is Invalid And Cannot Be Removed

Dec 10, 2010

I'm using the ChangePassword method of membership provider to change the password and one of the requirement before calling the ChangePassword is to retrieve the current password. But I'm getting error:

padding is invalid and cannot be removed

below is my web.config:

[code]....

View 1 Replies

C# - "Padding Is Invalid And Cannot Be Removed." Error With A Twist?

Sep 15, 2010

I'm getting the following error in our QA environment but only through the IIS7 reverse proxy. If I hit the application server directly it works fine. In our DEV environment it works fine through the proxy or directly.

I'm not really sure where to go with this,
Server Error in '/' Application.

Padding is invalid and cannot be removed.

Description: An unhandled exception occurred during the execution of the current web request.

Exception Details: System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed.

Source Error:An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:[CryptographicException: Padding is invalid and cannot be removed.]
System.Security.Cryptography.RijndaelManagedTransform.DecryptData(Byte[] inputBuffer, Int32 inputOffset,
[code]....
Version Information: Microsoft .NET Framework Version:2.0.50727.4952; ASP.NET Version:2.0.50727.4927

View 1 Replies

C# - Exception Is Like The Padding Is Invalid And Cannot Be Removed Exception?

Jul 12, 2010

We're getting this InternalSubStringWithChecks exception with our application's healthMonitoring. This exception is like the Padding is invalid and cannot be removed exception where it's being recorded and we're getting a notification email but the end user is unaware that an actual error has happened. Though we don't want our event log filled up with this rubbish! The stack trace is:

Parameter name: length
at System.String.InternalSubStringWithChecks(Int32 startIndex, Int32 length, Boolean fAlwaysCopy)
at System.Web.Handlers.AssemblyResourceLoader.System.Web.IHttpHandler.ProcessRequest
[code]...

View 1 Replies

Databases :: Oracle Dataset Fill Invalid ROWID?

May 12, 2010

I am using a Strored procedure which inserts data in to global temporary table and returns the result sets to Client. when i execute procedure from SQL Plus its working.where whene dataadapter.fill command is executed Invalid ROWID exception Is thrown.

View 2 Replies

Databases :: Executing Sql Script (oracle) Error / Invalid Character

Sep 22, 2010

i have a problem in executing an sql script [Code]....

the error was : "invalid character"

View 2 Replies

.net - Invalid Viewstate Error - OnPreRender?

Jan 19, 2010

I'm getting 100+ errors per day on my website with System.Web.HttpException: Invalid viewstate. The website is asp.net 3.5 running on iis6 , not running in a web-garden/web-farm , single server.Here are a few sample errors.

Machine: ML Framework Version: 2.0.50727.3603 Assembly Version: 6.5.3664.33889
Source: http://www.domain.com/WebResource.axd?d=z5VmXXoSLLpQHoPictureAlert
Exception: System.Web.HttpException: Invalid viewstate. at System.Web.UI.Page.DecryptStringWithIV(String s, IVType ivType) at

i already tried wraping all inline javascript with //<![CDATA[ //]]>

i already set enableViewStateMac to false.From looking at all the errors guessing out of the "d" paramter it seems to focus on a single usercontrol on my website.in this control i change the visiblity of div's + text in the usercontrol OnPreRender function.

protected override void OnPreRender(EventArgs e)
{
base.OnPreRender(e);
PreparePage();
}
Can the errors be related to the usercontrol behavioral?

View 2 Replies

Invalid Viewstate Error EVENT # 31890?

Jul 23, 2010

got this error.solve this?

EVENT # 31890

EVENT LOG Application

EVENT TYPE Warning

OPCODE Info

[code]...

View 1 Replies

State Management :: Viewstate Verification Failed - Invalid

Aug 9, 2010

I am having this problem with, it seems, Viewstate. This issue only occurs on certain machines, if I browse the website myself it works fine but if another user browses the pages they will lock up and timeout with the error "Viewstate verification failed. Reason: Viewstate was invalid." appering in the event log. Full error is as follows:

Event code: 4009
Event message: Viewstate verification failed. Reason: Viewstate was invalid.
Event time: 8/9/2010 12:09:17 PM
Event time (UTC): 8/9/2010 11:09:17 AM
Event ID: 343dfca250394b109bb5d03b2324f04a
Event sequence: 103
Event occurrence: 4
Event detail code: 50204
Application information:
Application domain: /LM/W3SVC/1/Root/AnseoEnterprise-3-129258250982968750
Trust level: Full
Application Virtual Path: /AnseoEnterprise

View 3 Replies

.net - Devexpress Grid - PerformCallback Generates Invalid Viewstate?

Dec 13, 2010

I have a DevExpress grid that needs to be refreshed every time the value in a combobox is changed. For example, I have a combobox that sets the grid's page size. One of the requirements is that the combobox does not cause a full postback.

The combobox is declared like this:

<asp:DropDownList ID="cboPages" AutoPostBack="false" runat="server"
EnableViewState="false" OnSelectedIndexChanged="cboPages_SelectedIndexChanged" />

On selected index changed, it sets a cookie whose value is the selected value. When the combobox value changes, a javascript function is called:

function PerformCallbackOnGrid(grid) {
try {
grid.PerformCallback("refresh");[code]....

The function is attached in code behind: this.cboPages.Attributes["onChange"] = "PerformCallbackOnGrid(" + this.GridClientID + ")";

After performing these steps:The user changes the grid page size using the combobox, so PerformCallback is called at least once.

The user presses F5(refresh).
The user tries to change the page size again.
an 'Invalid viewstate' error message appears.

I have tried setting ViewStateMode to Disabled for the grid, also EnableViewState="false".

View 2 Replies

State Management :: System.Web.UI.ViewStateException: Invalid Viewstate?

Oct 15, 2010

I had to switch to

sessionState
mode="StateServer"
timeout="30"/>

[code]...

View 2 Replies

Getting Error "invalid Character" In Statement - Doesn't Exist In Pl / Sql Developer Oracle

Feb 9, 2011

I keep getting an error saying invalid character in asp.net for the following query below, however that error doesnt exist in my pl/sql developer oracle. see code below

[Code]....

I think it has to do with my commit, hence how I do include commit in an update directly in the asp.net side.

View 12 Replies