Four vulnerabilities have been reported in Microsoft .NET Framework, which can be exploited by malicious people to cause a DoS (Denial of Service), conduct spoofing attacks, or bypass certain security restrictions.

1) An error within ASP.NET when hashing form posts and updating a hash table can be exploited to cause a hash collision resulting in high CPU consumption via a specially crafted form sent in a HTTP POST request.

Successful exploitation of this vulnerability requires that a site allows "application/x-www-form-urlencoded" or "multipart/form-data" HTTP content types.

2) An error in the verification of return URLs during the forms authentication process can be exploited to redirect a user to an arbitrary website without the user's knowledge to e.g. conduct phishing attacks.

Successful exploitation of this vulnerability requires that "Forms Authentication" is configured per-application to be enabled.

3) An error in the authentication process when handling specially crafted usernames can be exploited to access arbitrary users' accounts to an ASP.NET application via a specially crafted web request.

Successful exploitation of this vulnerability requires that "Forms Authentication" is configured per-application to be enabled and that a user can register an account on the ASP.NET application and knows of a target user's account name.

4) An error in the handling of cached content when "Forms Authentication" is used with sliding expiry can be exploited to execute arbitrary commands in context of a target user tricked into following a specially crafted link.

Successful exploitation of this vulnerability requires that ASP.NET responses are cached through use of the "OutputCache" directive.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
1) Alexander Klink, n.runs AG and Julian Wälde, Technische Universität Darmstadt.
2) Irene Abezgauz, Seeker Research Center
3) K. Gudinavicius, SEC Consult Vulnerability Lab
4) The vendor credits Oliver Dewdney, LBi

Changelog
Further details available to Secunia VIM customers

Original Advisory
MS11-100 (KB2638420, KB2656351, KB2656352, KB2656353, KB2656355, KB2656356, KB2656358, KB2656362, KB2657424):
http://technet.microsoft.com/en-us/security/bulletin/MS11-100

n.runs (SA-2011.004):
http://www.nruns.com/_downloads/advisory28122011.pdf

SEC Consult Vulnerability Lab:
https://www.sec-consult.com/files/20111230-0_asp.net_authentication_bypass_v1.0.txt

Seeker Research Center:
http://www.seekersec.com/advisories/AdvMS20120216.html

Other references
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers