CVE-2010-3332

Published: Sep 22, 2010Modified: Apr 29, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."

Affected (7)

Products: Microsoft: .net Framework

Microsoft

1 product

.net Framework

Configuration A

7 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 1.1 sp1
Microsoft .net Framework	Version 2.0 sp1
Microsoft .net Framework	Version 2.0 sp2
Microsoft .net Framework	Version 3.5.1
Microsoft .net Framework	Version 3.5
Microsoft .net Framework	Version 3.5 sp1
Microsoft .net Framework	Version 4.0

Running on/with	Platform Versions
Microsoft Internet Information Services	All versions

Related CWEs

CWE-209

Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.

References (40)

http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx

Source: secure@microsoft.com

Vendor Advisory

http://isc.sans.edu/diary.html?storyid=9568

Source: secure@microsoft.com

Third Party Advisory

http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/

Source: secure@microsoft.com

Third Party Advisory

http://secunia.com/advisories/41409

Source: secure@microsoft.com

Third Party Advisory

http://securitytracker.com/id?1024459

Source: secure@microsoft.com

Third Party AdvisoryVDB Entry

http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310

Source: secure@microsoft.com

Third Party Advisory

http://twitter.com/thaidn/statuses/24832350146

Source: secure@microsoft.com

Broken Link

http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx

Source: secure@microsoft.com

MitigationThird Party Advisory

http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx

Source: secure@microsoft.com

Third Party Advisory

http://www.ekoparty.org/juliano-rizzo-2010.php

Source: secure@microsoft.com

Broken Link

http://www.microsoft.com/technet/security/advisory/2416728.mspx

Source: secure@microsoft.com

Broken Link

http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle

Source: secure@microsoft.com

ExploitThird Party Advisory

http://www.securityfocus.com/bid/43316

Source: secure@microsoft.com

Third Party AdvisoryVDB Entry

http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security

Source: secure@microsoft.com

Third Party Advisory

http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html

Source: secure@microsoft.com

ExploitThird Party Advisory

http://www.vupen.com/english/advisories/2010/2429

Source: secure@microsoft.com

Third Party Advisory

http://www.vupen.com/english/advisories/2010/2751

Source: secure@microsoft.com

Third Party Advisory

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070

Source: secure@microsoft.com

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/61898

Source: secure@microsoft.com

Third Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12365

Source: secure@microsoft.com

Third Party Advisory

http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx