PT-2010-4743 · Microsoft+1 · .Net Framework+1

Juliano Rizzo + 1 · Published 2010-09-22 · Updated 2020-11-23 · CVE-2010-3332

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 1.1 SP1 through 4.0

Description The issue allows remote attackers to decrypt and modify encrypted View State form data via a padding oracle attack. This could possibly lead to forging cookies or reading application files. An information disclosure vulnerability exists due to improper error handling during encryption padding verification, allowing an attacker to read encrypted data, such as the view state. This vulnerability can also be used for data tampering, which could be used to decrypt and tamper with the data encrypted by the server. In Microsoft .NET Framework 3.5 Service Pack 1 and above, an attacker can retrieve the contents of any file within the ASP.NET application, including web.config.

Recommendations For Microsoft .NET Framework versions 1.1 SP1 through 4.0, update to a version that includes the fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to sensitive files within the ASP.NET application and disabling detailed error codes during decryption attempts to minimize the risk of exploitation. Avoid using the VIEWSTATE form data in sensitive operations until the issue is resolved.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2010-3332

SUSE-SU-2012_0393-1

Affected Products

.Net Framework

Suse

References · 33

• 🔥 http://troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html · Exploit
• 🔥 https://exploit-db.com/exploits/15292 · Exploit
• 🔥 http://mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle · Exploit
• 🔥 https://exploit-db.com/exploits/15213 · Exploit
• 🔥 https://exploit-db.com/exploits/15265 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3332 · Security Note
• http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3332 · Security Note
• http://ekoparty.org/juliano-rizzo-2010.php · Note
• http://vupen.com/english/advisories/2010/2751 · Note
• http://support.novell.com/security/cve/CVE-2010-3332.html · Note
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Note
• http://dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx · Note
• http://download.novell.com/patch/finder/?keywords=acf3e342c719d9e5ee642a15f5422903 · Note