CVE-2010-3332: Medium severity microsoft .net framework 4 vulnerability
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3332?
CVE-2010-3332 is considered a high severity vulnerability due to the potential for remote attackers to compromise encrypted data.
How do I fix CVE-2010-3332?
To address CVE-2010-3332, it is recommended to upgrade to a supported version of the Microsoft .NET Framework that does not exhibit this vulnerability.
What versions of .NET Framework are affected by CVE-2010-3332?
CVE-2010-3332 affects Microsoft .NET Framework versions 1.1 SP1, 2.0 SP1 & SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0.
What type of attack is possible with CVE-2010-3332?
CVE-2010-3332 allows remote attackers to decrypt and modify View State data, which can lead to unauthorized data manipulation.
Is Microsoft Internet Information Services affected by CVE-2010-3332?
Microsoft Internet Information Services itself is not directly affected; however, it can serve content from affected versions of the .NET Framework.