CVE-2010-3332 (GCVE-0-2010-3332)
Vulnerability from cvelistv5
Published
2010-09-22 18:00
Modified
2024-08-07 03:03
Severity ?
CWE
  • n/a
Summary
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."
References
http://www.ekoparty.org/juliano-rizzo-2010.php x_refsource_MISC
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12365 vdb-entry, signature, x_refsource_OVAL
http://www.vupen.com/english/advisories/2010/2751 vdb-entry, x_refsource_VUPEN
http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx x_refsource_MISC
http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx x_refsource_CONFIRM
http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html x_refsource_MISC
http://secunia.com/advisories/41409 third-party-advisory, x_refsource_SECUNIA
http://www.securityfocus.com/bid/43316 vdb-entry, x_refsource_BID
http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle x_refsource_CONFIRM
http://www.microsoft.com/technet/security/advisory/2416728.mspx x_refsource_CONFIRM
http://securitytracker.com/id?1024459 vdb-entry, x_refsource_SECTRACK
http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx x_refsource_CONFIRM
http://isc.sans.edu/diary.html?storyid=9568 x_refsource_MISC
http://www.vupen.com/english/advisories/2010/2429 vdb-entry, x_refsource_VUPEN
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070 vendor-advisory, x_refsource_MS
http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security x_refsource_MISC
http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310 x_refsource_MISC
http://twitter.com/thaidn/statuses/24832350146 x_refsource_MISC
http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/ x_refsource_MISC
https://exchange.xforce.ibmcloud.com/vulnerabilities/61898 vdb-entry, x_refsource_XF
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T03:03:18.963Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.ekoparty.org/juliano-rizzo-2010.php"
          },
          {
            "name": "oval:org.mitre.oval:def:12365",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12365"
          },
          {
            "name": "ADV-2010-2751",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/2751"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html"
          },
          {
            "name": "41409",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/41409"
          },
          {
            "name": "43316",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/43316"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.microsoft.com/technet/security/advisory/2416728.mspx"
          },
          {
            "name": "1024459",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1024459"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://isc.sans.edu/diary.html?storyid=9568"
          },
          {
            "name": "ADV-2010-2429",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/2429"
          },
          {
            "name": "MS10-070",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://twitter.com/thaidn/statuses/24832350146"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/"
          },
          {
            "name": "ms-aspdotnet-padding-info-disclosure(61898)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61898"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-09-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka \"ASP.NET Padding Oracle Vulnerability.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-12T19:57:01.000Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.ekoparty.org/juliano-rizzo-2010.php"
        },
        {
          "name": "oval:org.mitre.oval:def:12365",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12365"
        },
        {
          "name": "ADV-2010-2751",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/2751"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html"
        },
        {
          "name": "41409",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/41409"
        },
        {
          "name": "43316",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/43316"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.microsoft.com/technet/security/advisory/2416728.mspx"
        },
        {
          "name": "1024459",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1024459"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://isc.sans.edu/diary.html?storyid=9568"
        },
        {
          "name": "ADV-2010-2429",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/2429"
        },
        {
          "name": "MS10-070",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://twitter.com/thaidn/statuses/24832350146"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/"
        },
        {
          "name": "ms-aspdotnet-padding-info-disclosure(61898)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61898"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2010-3332",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka \"ASP.NET Padding Oracle Vulnerability.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.ekoparty.org/juliano-rizzo-2010.php",
              "refsource": "MISC",
              "url": "http://www.ekoparty.org/juliano-rizzo-2010.php"
            },
            {
              "name": "oval:org.mitre.oval:def:12365",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12365"
            },
            {
              "name": "ADV-2010-2751",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2010/2751"
            },
            {
              "name": "http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx",
              "refsource": "MISC",
              "url": "http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx"
            },
            {
              "name": "http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx",
              "refsource": "CONFIRM",
              "url": "http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx"
            },
            {
              "name": "http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html",
              "refsource": "MISC",
              "url": "http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html"
            },
            {
              "name": "41409",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/41409"
            },
            {
              "name": "43316",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/43316"
            },
            {
              "name": "http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle",
              "refsource": "CONFIRM",
              "url": "http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle"
            },
            {
              "name": "http://www.microsoft.com/technet/security/advisory/2416728.mspx",
              "refsource": "CONFIRM",
              "url": "http://www.microsoft.com/technet/security/advisory/2416728.mspx"
            },
            {
              "name": "1024459",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1024459"
            },
            {
              "name": "http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx",
              "refsource": "CONFIRM",
              "url": "http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx"
            },
            {
              "name": "http://isc.sans.edu/diary.html?storyid=9568",
              "refsource": "MISC",
              "url": "http://isc.sans.edu/diary.html?storyid=9568"
            },
            {
              "name": "ADV-2010-2429",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2010/2429"
            },
            {
              "name": "MS10-070",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070"
            },
            {
              "name": "http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security",
              "refsource": "MISC",
              "url": "http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security"
            },
            {
              "name": "http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310",
              "refsource": "MISC",
              "url": "http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310"
            },
            {
              "name": "http://twitter.com/thaidn/statuses/24832350146",
              "refsource": "MISC",
              "url": "http://twitter.com/thaidn/statuses/24832350146"
            },
            {
              "name": "http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/",
              "refsource": "MISC",
              "url": "http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/"
            },
            {
              "name": "ms-aspdotnet-padding-info-disclosure(61898)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61898"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2010-3332",
    "datePublished": "2010-09-22T18:00:00.000Z",
    "dateReserved": "2010-09-14T00:00:00.000Z",
    "dateUpdated": "2024-08-07T03:03:18.963Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.