CVE-2010-3332
57Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actepss 67%
from disclosure to weapon14 days
Published on NVDSep 22
1st PoC+14d
VulnCheck+399d
exploitation probability
67%top 1% of all CVEs
observed exploitation
yesVulnCheck
4 public exploit(s)
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."
Affected products
n/a · n/apublic PoCs found — 4✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/15213exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/15265exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/15292githubgithub.com/bongbongco/MS10-070★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspxhttp://isc.sans.edu/diary.html?storyid=9568http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-070http://secunia.com/advisories/41409http://securitytracker.com/id?1024459https://exchange.xforce.ibmcloud.com/vulnerabilities/61898https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12365http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310http://twitter.com/thaidn/statuses/24832350146http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspxhttp://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx