Possible false positives - ASP.Net Information Leak Vulnerability

hydraflow — Fri, 14 Sep 2012 14:24:42 GMT

Starting on September 4th we've been seeing multiple "ASP.Net Information Leak Vulnerability" warnings in our logs. They are showing as originating from multiple sources within our internal network. Malware scans come up with nothing on these workstations and we haven't made any changes to anything. Is anyone else seeing these?

Re: Possible false positives - ASP.Net Information Leak Vulnerability

UhMayYeah — Fri, 14 Sep 2012 20:04:23 GMT

Hello ,

Microsoft ASP.Net Information Leak brute force Attempt alert Threat Id : 40022 is looking for 40 events of Signature 33435 (

ASP.Net Information Leak Vulnerability) in 30 seconds, which is looking for HTTP 500 and an X-Powered-By: ASP.NET in the response header.

More information is available at :

http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx

Note : This is often a false positive due to a proxy or misconfigured ASP scripts.

For Future Reference :

To report a false positive ,please open a case with Support providing information listed with following article:

https://live.paloaltonetworks.com/docs/DOC-2769

-Ameya

topic Possible false positives - ASP.Net Information Leak Vulnerability in General Topics

Possible false positives - ASP.Net Information Leak Vulnerability

Re: Possible false positives - ASP.Net Information Leak Vulnerability