RedirectMode in ASP.NET Security Vulnerability

Question

In a Scott Guthries blog post about ASP.NET security vulnerability noted here , he says that for ASP.NET 3.5 SP1 + there should be the following attribute in the user error section

redirectMode="ResponseRewrite"

What is the significance of this in relation to vulnerability and why only 3.5 SP1 and higher?

Answer 1

ResponseRedirect provides the attacker with information about the time it takes to get the redirect header.

ResponseRewrite did not return the redirect header, so the attacker did not know this time.

, , , error.aspx . ResponceRewrite, .

3.5 SP1 , .s

Answer 2

3.5 SP1 ? .

. (ResponseRedirect) . ResponseRewrite - Uri. , , .

MSDN ...