MicrosoftCVELIST:CVE-2010-3332CVE-2010-3332
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka “ASP.NET Padding Oracle Vulnerability.”
References
blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx
isc.sans.edu/diary.html?storyid=9568
pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/
secunia.com/advisories/41409
securitytracker.com/id?1024459
threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310
twitter.com/thaidn/statuses/24832350146
weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx
www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx
www.ekoparty.org/juliano-rizzo-2010.php
www.microsoft.com/technet/security/advisory/2416728.mspx
www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle
www.securityfocus.com/bid/43316
www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security
www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html
www.vupen.com/english/advisories/2010/2429
www.vupen.com/english/advisories/2010/2751
docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070
exchange.xforce.ibmcloud.com/vulnerabilities/61898
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12365
Related
