A vulnerability has been reported in Mono ASP.NET, which can be exploited by malicious people to disclose sensitive information.

The vulnerability is caused due to improper error handling within ASP.NET during cryptographic padding verification with certain algorithms. This can be exploited to decrypt data, e.g. the View State, via returned error codes from an affected server.

This is related to:
SA41409

Solution
Update to version 2.8.1.

Provided and/or discovered by
Juliano Rizzo and Thai Duong

Changelog
Further details available to Secunia VIM customers

Original Advisory
Mono:
http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle

Juliano Rizzo and Thai Duong:
http://netifera.com/research/poet//PaddingOraclesEverywhereEkoparty2010.pdf

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers