CVE-2010-3332

MEDIUM 6.4CVE-2010-3332 · Published 22/09/2010 · updated 16/06/2026

In short

CVE-2010-3332 is a MEDIUM (CVSS 6.4) vulnerability affecting .net framework (microsoft).
Chance of exploitation in the next 30 days (EPSS): 68.2%, higher than 99.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
.net framework microsoft	`= 1.1= 2.0= 3.5= 3.5.1= 4.0`	No fix yet

Description

Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."

References

blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx · Vendor Advisory
isc.sans.edu/diary.html · Third Party Advisory
pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do · Third Party Advisory
secunia.com/advisories/41409 · Third Party Advisory
securitytracker.com/id · Third Party Advisory
threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310 · Third Party Advisory
twitter.com/thaidn/statuses/24832350146 · Broken Link
weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx · Mitigation
dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx · Third Party Advisory
ekoparty.org/juliano-rizzo-2010.php

More vulnerabilities in .net framework

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free