Microsoft warns of .NET vulnerability

Microsoft is warning people of a potentially serious vulnerability in its ASP.NET framework used to create Web sites.

The hole affects all versions of the .NET framework and affects Windows XP, Vista, Windows 7, and Windows Server 2003 and 2008, company said in an advisory released late on Friday. "At this time we are not aware of any attacks using this vulnerability and we encourage customers to review the advisory for mitigations and workarounds," the company said in a blog post.

The vulnerability is caused by ASP.NET providing Web clients details in error messages when decrypting certain ciphertext, Microsoft said. An attacker could be able to read or tamper with data that was encrypted by the server, as well as read data from files on the target server.

For more on this story, read Microsoft warns of .NET vulnerability on CNET News.