CVE-2010-3332
First published: Wed Sep 22 2010(Updated: )
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft .NET Framework | =1.1-sp1 | |
| Microsoft .NET Framework | =2.0-sp1 | |
| Microsoft .NET Framework | =2.0-sp2 | |
| Microsoft .NET Framework | =3.5 | |
| Microsoft .NET Framework | =3.5-sp1 | |
| Microsoft .NET Framework | =3.5.1 | |
| Microsoft .NET Framework | =4.0 | |
| Microsoft Internet Information Services |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://twitter.com/thaidn/statuses/24832350146
- http://secunia.com/advisories/41409
- http://securitytracker.com/id?1024459
- http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx
- http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html
- http://www.ekoparty.org/juliano-rizzo-2010.php
- http://www.securityfocus.com/bid/43316
- http://isc.sans.edu/diary.html?storyid=9568
- http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx
- http://www.vupen.com/english/advisories/2010/2429
- http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security
- http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/
- http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx
- http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310
- http://www.microsoft.com/technet/security/advisory/2416728.mspx
- http://www.vupen.com/english/advisories/2010/2751
- http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle
- https://exchange.xforce.ibmcloud.com/vulnerabilities/61898
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12365
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070
- collector/nvd-historical
- collector/nvd-index
- agent/weakness
- agent/references
- agent/severity
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/event
- agent/author
- agent/type
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/microsoft
- canonical/microsoft .net framework
- version/microsoft .net framework/1.1-sp1
- version/microsoft .net framework/2.0-sp1
- version/microsoft .net framework/2.0-sp2
- version/microsoft .net framework/3.5
- version/microsoft .net framework/3.5-sp1
- version/microsoft .net framework/3.5.1
- version/microsoft .net framework/4.0
- canonical/microsoft internet information services