CVE-2005-1665 The __VIEWSTATE functionality in Microsoft ASP.NET 1.x, when not cryptographically signed, allows remote attackers to cause a denial of service (CPU consumption) via deeply nested markup.
MediumCVSS 5.0
EPSS 40.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The __VIEWSTATE functionality in Microsoft ASP.NET 1.x, when not cryptographically signed, allows remote attackers to cause a denial of service (CPU consumption) via deeply nested markup.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft asp.net | = 1.0 | No fix listed |
| Microsoft asp.net | = 1.1 | No fix listed |
References
- 20050503 ASP.NET __VIEWSTATE crypto validation prone to replay attacks mailing-list
- scottonwriting.net vendor-advisory
- 15241 third-party-advisory vendor-advisory
- 16195 vdb-entry
- ms-aspnet-viewstate-dos(20408) vdb-entry