While reading up on view state as a possible means to prevent CSRF, I came across this Microsoft Security Bulletin which states:
An attacker who successfully exploited this vulnerability could read data, such as the view state, which was encrypted by the server.
I had always heard that encrypted view state was secure. Does anyone have any details on how this exploit works? I did some googling but didn't find any details.