Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using Windows Server 2008, Plesk 9.5, IIS 7, SQL Server 2008, and recently I have received and email claiming this server is vulnerable, and sent me the following URL:


Using this URL on any website that I hosted on the server, I could see the web.config file. I would like to know whether this indeed is a vulnerability, and if so, how to mitigate it?

share|improve this question

Sounds like that's the padding oracle attack that came out in 2010. You should check your server for the appropriate MS patch (MS10-070).

There's more information on the attack here

share|improve this answer
thank you for your answer,i did solve the problem by installing latest patches of dot-net fretwork that released by Microsoft – jack Bauer Jul 13 '13 at 20:28
@jackBauer - Sounds like you ought to accept Rory's answer then, since it solved the problem presented in your question. ;) – TildalWave Jul 13 '13 at 23:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.