Vulnerability in ASP.NET Could Allow Information Disclosure (2416728)

  Severity: HIGH
  CVE Identifier: CVE-2010-3332
  Advisory Date: SEP 21, 2010

  DESCRIPTION

Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."

  TREND MICRO PROTECTION INFORMATION

For more information, please refer to this Microsoft page:


Trend Micro clients using OfficeScan with Intrusion Defense Firewall (IDF) may refer to the table below for the pattern filter identifier(s):

Vulnerability ID Identifier & Title IDF First Pattern Version IDF First Pattern Release Version
CVE-2010-3332 1004409 - Microsoft .NET Framework ASP.NET 'Padding Oracle' Information Disclosure Vulnerability 10-030 Sep 21, 2010

  SOLUTION

  PATCH: http://www.microsoft.com/technet/security/bulletin/MS10-070.mspx

  Trend Micro Deep Security DPI Rule Number: 1004409
  Trend Micro Deep Security DPI Rule Name: Microsoft .NET Framework ASP.NET 'Padding Oracle' Information Disclosure Vulnerability

  AFFECTED SOFTWARE AND VERSION

  • Windows XP Media Center Edition 2005 and Windows XP Tablet PC Edition 2005
  • Windows XP Service Pack 3
  • Windows XP Professional x64 Edition Service Pack 2
  • Windows Server 2003 Service Pack 2
  • Windows Server 2003 x64 Edition Service Pack 2
  • Windows Server 2003 with SP2 for Itanium-based Systems
  • Windows Vista Service Pack 1
  • Windows Vista Service Pack 2
  • Windows Vista x64 Edition Service Pack 1
  • Windows Vista x64 Edition Service Pack 2
  • Windows Server 2008 for 32-bit Systems**
  • Windows Server 2008 for 32-bit Systems Service Pack 2**
  • Windows Server 2008 for x64-based Systems**
  • Windows Server 2008 for x64-based Systems Service Pack 2**
  • Windows Server 2008 for Itanium-based Systems
  • Windows Server 2008 for Itanium-based Systems Service Pack 2
  • Windows 7 for 32-bit Systems
  • Windows 7 for x64-based Systems
  • Windows Server 2008 R2 for x64-based Systems*
  • Windows Server 2008 R2 for Itanium-based systems