CVEvulnerability
CVE-2010-3332
6.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2010-09-22
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-209
Description
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."
Affected configurations
• microsoft .net framework 1.1
• microsoft .net framework 2.0
• microsoft .net framework 3.5
• microsoft .net framework 3.5.1
• microsoft .net framework 4.0
Related
Weakness · CWE (1)
- CWE-209 Generation of Error Message Containing Sensitive Information weakness
References
- http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx Vendor Advisory
- http://isc.sans.edu/diary.html?storyid=9568 Third Party Advisory
- http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/ Third Party Advisory
- http://secunia.com/advisories/41409 Third Party Advisory
- http://securitytracker.com/id?1024459 Third Party Advisory, VDB Entry
- http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310 Third Party Advisory
- http://twitter.com/thaidn/statuses/24832350146 Broken Link
- http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx Mitigation, Third Party Advisory
- http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx Third Party Advisory
- http://www.ekoparty.org/juliano-rizzo-2010.php Broken Link
- http://www.microsoft.com/technet/security/advisory/2416728.mspx Broken Link
- http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle Exploit, Third Party Advisory
- http://www.securityfocus.com/bid/43316 Third Party Advisory, VDB Entry
- http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security Third Party Advisory
- http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html Exploit, Third Party Advisory
- http://www.vupen.com/english/advisories/2010/2429 Third Party Advisory
- http://www.vupen.com/english/advisories/2010/2751 Third Party Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/61898 Third Party Advisory, VDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12365 Third Party Advisory
- http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx Vendor Advisory
- http://isc.sans.edu/diary.html?storyid=9568 Third Party Advisory
- http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/ Third Party Advisory
- http://secunia.com/advisories/41409 Third Party Advisory
- http://securitytracker.com/id?1024459 Third Party Advisory, VDB Entry
- http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310 Third Party Advisory
- http://twitter.com/thaidn/statuses/24832350146 Broken Link
- http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx Mitigation, Third Party Advisory
- http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx Third Party Advisory
- http://www.ekoparty.org/juliano-rizzo-2010.php Broken Link
- http://www.microsoft.com/technet/security/advisory/2416728.mspx Broken Link
- http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle Exploit, Third Party Advisory
- http://www.securityfocus.com/bid/43316 Third Party Advisory, VDB Entry
- http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security Third Party Advisory
- http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html Exploit, Third Party Advisory
- http://www.vupen.com/english/advisories/2010/2429 Third Party Advisory
- http://www.vupen.com/english/advisories/2010/2751 Third Party Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/61898 Third Party Advisory, VDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12365 Third Party Advisory