Cookie not RFC-compliant with Asp.net flows

Hi,

 

 

I have some strange blocked requests because of "Cookie not RFC-compliant".

 

 

Examples :

 

Invalid carriage return, Invalid equal sign preceding cookie name, Invalid space in cookie name

 

 

Its occurs when a netsurfer is on an Asp.Net site wich then POST a request to our "J2EE" Asm-ed website (with JSESSION_ID)

 

 

Each request, bring some fields "__EVENTTARGET, __EVENTARGUMENT and __VIEWSTATE" which containes many hexa caracters which could brinf some carriege returns,...

 

 

I don't know why, but the ASM indicate that my J2EE cookie are not RFC Compliant with errors shown before, even if they seems to be good :

 

 

Examples :

 

Cookie: JSESSIONID=9A94EF6C61A619C0523F677C90B7686A.tpsips01v-ubzprd-sips_payment_bnp-1; TS33fc98=588fae4afe8d5d0cf89a37a5658796c6a7fb8c370296a6a24c287da760ac0ec577b9df1c

 

Cookie: JSESSIONID=17FBA3FBEC808CE7DD0ADEC8B13B3409.tpsips01v-ubzprd-sips_payment_bnp-1; TS33fc98=3d929ae670ed124cbc683f7224d80b1545afbc290d4c52da4c286a7660ac0ec58f3e6bfa

 

 

and the errors are :

 

 

Invalid carriage return

 

prod/callpayment0xd0xaCookie:0x20JSESSI

 

 

Invalid space in cookie name

 

ie:0x20JSESSIONID=6EED3031E7ED195FD

 

 

 

Question 1 : Is it a buffer overflow due to Asp.net long fields wich make false-positive on my cookies ?

 

 

Question 2 : If yes, how to prevent RFC cookie non compliant rules without "live" delete any Asp.net fields ?

 

 

Question 3 : If no, what is the problem and how must I do....?

 

 

Thanks in advance,

 

Rodolphe (fr)