Is ASP.NET MVC vulnerable to the oracle padding attack?

Question

Is ASP.NET MVC 2 vulnerable to the oracle padding attack? If so, what workaround should be implemented? The instructions on Scott Gu\'s blog appear to only be for Webforms

Answer 1

Yes - linkage to the comment by Scott Guthrie.

Saturday, September 18, 2010 9:00 PM by ScottGu

@Vijay,

Will the ASP.NET MVC too get affected?

Yes - all versions of ASP.NET are affected, including ASP.NET MVC.

Thanks,

Scott

I see that you've seen the comment, but if you run the vbs script on your server, it should tell you if it's still a problem.

Edit: Also, Scott has discussed FAQs in a new post here.