Vulnerability

Vulnerability in ASP.NET Could Allow Information Disclosure (2416728)

Publish date: March 06, 2013

CVE-2010-3332

SEVERITY

HIGH

//  ADVISORY DATE

21 SEP 2010


DESCRIPTION

Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."

TREND MICRO PROTECTION INFORMATION

For more information, please refer to this Microsoft page:


Trend Micro clients using OfficeScan with Intrusion Defense Firewall (IDF) may refer to the table below for the pattern filter identifier(s):

Vulnerability ID Identifier & Title IDF First Pattern Version IDF First Pattern Release Version
CVE-2010-3332 1004409 - Microsoft .NET Framework ASP.NET 'Padding Oracle' Information Disclosure Vulnerability 10-030 Sep 21, 2010

SOLUTION

PATCH: http://www.microsoft.com/technet/security/bulletin/MS10-070.mspx

Trend Micro Deep Security DPI Rule Number: 1004409

Trend Micro Deep Security DPI Rule Name: Microsoft .NET Framework ASP.NET 'Padding Oracle' Information Disclosure Vulnerability

AFFECTED SOFTWARE AND VERSION

  • Windows XP Media Center Edition 2005 and Windows XP Tablet PC Edition 2005
  • Windows XP Service Pack 3
  • Windows XP Professional x64 Edition Service Pack 2
  • Windows Server 2003 Service Pack 2
  • Windows Server 2003 x64 Edition Service Pack 2
  • Windows Server 2003 with SP2 for Itanium-based Systems
  • Windows Vista Service Pack 1
  • Windows Vista Service Pack 2
  • Windows Vista x64 Edition Service Pack 1
  • Windows Vista x64 Edition Service Pack 2
  • Windows Server 2008 for 32-bit Systems**
  • Windows Server 2008 for 32-bit Systems Service Pack 2**
  • Windows Server 2008 for x64-based Systems**
  • Windows Server 2008 for x64-based Systems Service Pack 2**
  • Windows Server 2008 for Itanium-based Systems
  • Windows Server 2008 for Itanium-based Systems Service Pack 2
  • Windows 7 for 32-bit Systems
  • Windows 7 for x64-based Systems
  • Windows Server 2008 R2 for x64-based Systems*
  • Windows Server 2008 R2 for Itanium-based systems

Featured Stories

Connect with us on