After you apply security update MS10-070 to servers that serve Microsoft ASP.NET websites that are deployed in a web farm, some servers or applications in the web farm may encounter one or more of the following symptoms:
-
Failure to decrypt data
-
Exceptions in the WebResource or ScriptResource handlers
-
Authentication failures when using Forms Authentication
-
"Invalid Viewstate" exceptions
-
"Unable to validate data" exceptions when trying to decrypt data such as Forms Authentication cookie
The failure could manifest as an application exception when accessing the ASP.NET application, and information that resembles the following may also be logged in the Application log. Message 1:
System.Web.HttpException : Unable to validate data. at System.Web.Configuration.MachineKeySection.EncryptOrDecryptData(Boolean fEncrypt, Byte[] buf, Byte[] modifier, Int32 start, Int32 length, IVType ivType, Boolean useValidationSymAlgo, Boolean signData) Message 2:
Event Type: WarningEvent Source: ASP.NET 2.0.50727.0Event Category: Web Event Event ID: 1309Date: DateTime: TimeUser: N/ADescription:Event code: 3005 Event message: An unhandled exception has occurred. Exception information: Exception type: HttpException Exception message: Unable to validate data.
Symptoms
The security update that bulletin MS10-070 addresses changes the default behavior of encryption in ASP.NET. The new default behavior after the security update is installed is to perform validation in addition to encryption even if only encryption is requested. This default behavior changes the encrypted payload on servers where this update is applied. The payload may include view state and forms authentication cookies. If a web farm has only some servers on which the security update is applied, there will be a difference in encryption and decryption methods on the same payload across different servers in the web farm, and this difference in behavior results in exceptions. This behavior can also occur if forms authentication cookies that are persisted on systems before applying the security update are consumed after the security update is applied.Also, the encryption and decryption methods are different for different service pack versions of the Microsoft .NET Framework 2.0. Therefore, having different service pack levels for the .NET Framework in a web farm environment that has the security update installed results in different encrypted payloads and a similar decryption failure.
Cause
Verify the following conditions are true on all the servers that are serving the ASP.NET content:
-
All servers that serve an ASP.NET website in the web farm have to install the security update. If some servers do not have the security update installed, you must apply the update to these servers.
-
All computers that are running some version of the .NET Framework 2.0 in the web farm have to be at the same service pack level if the MS10-070 security update is applied to all the systems. If there is a difference in the service pack levels on the servers, you must update all the servers to the latest service pack and reapply all security updates. Therefore, if some servers in the web farm are running the .NET Framework 2.0 SP1, and other servers are running the .NET Framework 2.0 SP2, all the .NET Framework 2.0 SP1 servers must be upgraded to the .NET Framework 2.0 SP2 before you apply the security update to all the servers in the web farm.
-
Make sure that applications are not consuming encrypted data, such as Forms Authentication cookies that were generated before the update was applied. Previously-encrypted data must be refreshed after the security update is applied.
For more information about how to detect the .NET Framework versions and for security update installation on your servers, see the “References” section.
Resolution
For more information about the ASP.NET view state, please refer to the following article:
ASP.NET View State OverviewFor more information about ASP.NET Forms Authentication, please refer to the following article:
ASP.NET Forms Authentication OverviewFor more information about ASP.NET Forms Authentication tickets and cookies, click the following article number to view the article in the Microsoft Knowledge Base:
910443 Understanding the Forms Authentication Ticket and Cookie For more information about ASP.NET Web Resource handler, click the following article number to view the article in the Microsoft Knowledge Base:
910442 Working with Web Resources in ASP.NET 2.0
