风险等级: 高
  CVE标识符: : CVE-2010-3332
  建议日期 : 2010年9月21日

  描述

Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."

  保护信息

For more information, please refer to this Microsoft page:


Trend Micro clients using OfficeScan with Intrusion Defense Firewall (IDF) may refer to the table below for the pattern filter identifier(s):

Vulnerability ID Identifier & Title IDF First Pattern Version IDF First Pattern Release Version
CVE-2010-3332 1004409 - Microsoft .NET Framework ASP.NET 'Padding Oracle' Information Disclosure Vulnerability 10-030 Sep 21, 2010

  解决方案

  补丁: http://www.microsoft.com/technet/security/bulletin/MS10-070.mspx

  Trend Micro Deep Security DPI Rule Number: 1004409
  Trend Micro Deep Security DPI Rule Name: Microsoft .NET Framework ASP.NET 'Padding Oracle' Information Disclosure Vulnerability

  受感染软件和版本:

  • Windows XP Media Center Edition 2005 and Windows XP Tablet PC Edition 2005
  • Windows XP Service Pack 3
  • Windows XP Professional x64 Edition Service Pack 2
  • Windows Server 2003 Service Pack 2
  • Windows Server 2003 x64 Edition Service Pack 2
  • Windows Server 2003 with SP2 for Itanium-based Systems
  • Windows Vista Service Pack 1
  • Windows Vista Service Pack 2
  • Windows Vista x64 Edition Service Pack 1
  • Windows Vista x64 Edition Service Pack 2
  • Windows Server 2008 for 32-bit Systems**
  • Windows Server 2008 for 32-bit Systems Service Pack 2**
  • Windows Server 2008 for x64-based Systems**
  • Windows Server 2008 for x64-based Systems Service Pack 2**
  • Windows Server 2008 for Itanium-based Systems
  • Windows Server 2008 for Itanium-based Systems Service Pack 2
  • Windows 7 for 32-bit Systems
  • Windows 7 for x64-based Systems
  • Windows Server 2008 R2 for x64-based Systems*
  • Windows Server 2008 R2 for Itanium-based systems