Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2010-3332 | First vendor Publication | 2010-09-22 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 6.4 | Attack Range | Network |
| Cvss Impact Score | 4.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability." |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3332 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-209 | Information Exposure Through an Error Message |
OVAL Definitions
CPE : Common Platform Enumeration
ExploitDB Exploits
| id | Description |
|---|---|
| 2010-10-20 | MS10-070 ASP.NET Auto-Decryptor File Download Exploit |
| 2010-10-17 | MS10-070 ASP.NET Padding Oracle File Download |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-08-10 | Name : Gentoo Security Advisory GLSA 201206-13 (mono mono-debugger) File : nvt/glsa_201206_13.nasl |
| 2010-09-29 | Name : Microsoft ASP.NET Information Disclosure Vulnerability (2418042) File : nvt/secpod_ms10-070_remote.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 68127 | Microsoft ASP.NET ViewState Cryptographic Padding Remote Information Disclosure Microsoft .NET Framework contains a flaw that may lead to an unauthorized information disclosure. Â The issue is triggered when the component provides detailed error codes during decryption attempts, which will disclose View State form data to a remote attacker via a padding oracle attack. This may also potentially allow for the forging of cookies or reading of application files. |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Microsoft Windows ASP.NET information disclosure attempt RuleID : 17429 - Revision : 16 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows ASP.NET information disclosure attempt RuleID : 17428 - Revision : 17 - Type : OS-WINDOWS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2012-06-22 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201206-13.nasl - Type : ACT_GATHER_INFO |
| 2012-03-21 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_bytefx-data-mysql-8001.nasl - Type : ACT_GATHER_INFO |
| 2011-04-22 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_bytefx-data-mysql-110331.nasl - Type : ACT_GATHER_INFO |
| 2010-10-29 | Name : A web application hosted on the remote server is potentially prone to a paddi... File : padding_oracle.nasl - Type : ACT_MIXED_ATTACK |
| 2010-10-08 | Name : The version of the .NET framework installed on the remote host has an informa... File : padding_oracle_ms10-070.nasl - Type : ACT_ATTACK |
| 2010-09-28 | Name : The version of the .NET framework installed on the remote host has an informa... File : smb_nt_ms10-070.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:07:31 |
|
| 2024-11-28 12:22:52 |
|
| 2020-11-24 00:22:46 |
|
| 2020-05-23 00:26:27 |
|
| 2018-10-13 00:22:59 |
|
| 2017-09-19 09:23:56 |
|
| 2017-08-17 09:23:06 |
|
| 2016-06-29 00:15:00 |
|
| 2016-04-26 20:04:49 |
|
| 2014-02-17 10:57:20 |
|
| 2014-01-19 21:27:09 |
|
| 2013-05-10 23:32:10 |
|
