CVE-2010-3332
First published: Wed Sep 22 2010(Updated: )
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft .NET Framework | =1.1-sp1 | |
| Microsoft .NET Framework | =2.0-sp1 | |
| Microsoft .NET Framework | =2.0-sp2 | |
| Microsoft .NET Framework | =3.5 | |
| Microsoft .NET Framework | =3.5-sp1 | |
| Microsoft .NET Framework | =3.5.1 | |
| Microsoft .NET Framework | =4.0 | |
| Microsoft Internet Information Services (IIS) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://twitter.com/thaidn/statuses/24832350146
- http://secunia.com/advisories/41409
- http://securitytracker.com/id?1024459
- http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx
- http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html
- http://www.ekoparty.org/juliano-rizzo-2010.php
- http://www.securityfocus.com/bid/43316
- http://isc.sans.edu/diary.html?storyid=9568
- http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx
- http://www.vupen.com/english/advisories/2010/2429
- http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security
- http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/
- http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx
- http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310
- http://www.microsoft.com/technet/security/advisory/2416728.mspx
- http://www.vupen.com/english/advisories/2010/2751
- http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle
- https://exchange.xforce.ibmcloud.com/vulnerabilities/61898
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12365
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070
Frequently Asked Questions
What is the severity of CVE-2010-3332?
CVE-2010-3332 is considered a high severity vulnerability due to the potential for remote attackers to compromise encrypted data.
How do I fix CVE-2010-3332?
To address CVE-2010-3332, it is recommended to upgrade to a supported version of the Microsoft .NET Framework that does not exhibit this vulnerability.
What versions of .NET Framework are affected by CVE-2010-3332?
CVE-2010-3332 affects Microsoft .NET Framework versions 1.1 SP1, 2.0 SP1 & SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0.
What type of attack is possible with CVE-2010-3332?
CVE-2010-3332 allows remote attackers to decrypt and modify View State data, which can lead to unauthorized data manipulation.
Is Microsoft Internet Information Services affected by CVE-2010-3332?
Microsoft Internet Information Services itself is not directly affected; however, it can serve content from affected versions of the .NET Framework.
- collector/nvd-historical
- agent/references
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/author
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/microsoft
- canonical/microsoft .net framework
- version/microsoft .net framework/1.1-sp1
- version/microsoft .net framework/2.0-sp1
- version/microsoft .net framework/2.0-sp2
- version/microsoft .net framework/3.5
- version/microsoft .net framework/3.5-sp1
- version/microsoft .net framework/3.5.1
- version/microsoft .net framework/4.0
- canonical/microsoft internet information services (iis)