Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am using Windows Server 2008, Plesk 9.5, IIS 7, SQL Server 2008, and recently I have received and email claiming this server is vulnerable, and sent me the following URL:


Using this URL on any website that I hosted on the server, I could see the web.config file. I would like to know whether this indeed is a vulnerability, and if so, how to mitigate it?

share|improve this question

1 Answer 1

Sounds like that's the padding oracle attack that came out in 2010. You should check your server for the appropriate MS patch (MS10-070).

There's more information on the attack here

share|improve this answer
thank you for your answer,i did solve the problem by installing latest patches of dot-net fretwork that released by Microsoft –  jack Bauer Jul 13 '13 at 20:28
@jackBauer - Sounds like you ought to accept Rory's answer then, since it solved the problem presented in your question. ;) –  TildalWave Jul 13 '13 at 23:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.