NVD

Id
14737  
Name
CVE-2010-3332  
Description
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-18  
Published
2010-09-22  
Modified Date
2011-10-03  
Seq
2010-3332  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
81649 14737 CVE-2010-3332 http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx  View
81650 14737 CVE-2010-3332 http://isc.sans.edu/diary.html?storyid=9568  View
81651 14737 CVE-2010-3332 oval:org.mitre.oval:def:12365  View
81652 14737 CVE-2010-3332 http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/  View
81653 14737 CVE-2010-3332 1024459  View
81654 14737 CVE-2010-3332 http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310  View
81655 14737 CVE-2010-3332 http://twitter.com/thaidn/statuses/24832350146  View
81656 14737 CVE-2010-3332 http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx  View
81657 14737 CVE-2010-3332 http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx  View
81658 14737 CVE-2010-3332 http://www.ekoparty.org/juliano-rizzo-2010.php  View
81659 14737 CVE-2010-3332 http://www.microsoft.com/technet/security/advisory/2416728.mspx  View
81660 14737 CVE-2010-3332 MS10-070  View
81661 14737 CVE-2010-3332 http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle  View
81662 14737 CVE-2010-3332 43316  View
81663 14737 CVE-2010-3332 http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security  View
81664 14737 CVE-2010-3332 http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html  View
81665 14737 CVE-2010-3332 ADV-2010-2429  View
81666 14737 CVE-2010-3332 ADV-2010-2751  View
81667 14737 CVE-2010-3332 ms-aspdotnet-padding-info-disclosure(61898)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
36335 JVNDB-2010-002115 Microsoft .NET Framework における View State フォームデータを復号または変更される脆弱性 Microsoft .NET Framework は、復号化を実行中に詳細なエラーコードを提供してしまうため、暗号化した View State フォームデータを復号または変更され、cookies を偽装されたり、アプリケーションファイルを読まれる脆弱性が存在します。 CVE-2010-3332 45912 CVE-2010-3332 14737 5 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-002115.html 2010-09-17 2010-10-08 View