Microsoft .NET Framework contains a flaw that may lead to an unauthorized information disclosure.  The issue is triggered when the component provides detailed error codes during decryption attempts, which will disclose View State form data to a remote attacker via a padding oracle attack. This may also potentially allow for the forging of cookies or reading of application files.

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

• Security Tracker: 1024459
• Exploit Database: 15213 15265 15292
• CVE ID: 2010-3332 (see also: NVD)
• Secunia Advisory ID: 41409 41919 44116 49637
• SCIP VulDB ID: 4208
• Bugtraq ID: 43316
• ISS X-Force ID: 61898
• VUPEN Advisory: ADV-2010-2429
• Vendor Specific News/Changelog Entry: http://blogs.technet.com/b/srd/archive/2010/09/17/understanding-the-asp-net-vulnerability.aspx
  http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00000.html
  http://security.gentoo.org/glsa/glsa-201206-13.xml
  http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx
• Other Advisory URL: http://isc.sans.edu/diary.html?storyid=9568
  http://netifera.com/research/poet//PaddingOraclesEverywhereEkoparty2010.pdf
  http://pentonizer.com/general-programming/aspnet-poet-vulnerability-what-else-can-i-do/
  http://twitter.com/thaidn/statuses/24832350146
  http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryId/2799/Oracle-Padding-Vulnerability-in-ASP-NET.aspx
  http://www.ekoparty.org/juliano-rizzo-2010.php
  http://www.theinquirer.net/inquirer/news/1732956/security-researchers-destroy-microsoft-aspnet-security
  http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html
• Mail List Post: http://threatpost.com/en_us/blogs/new-crypto-attack-affects-millions-aspnet-apps-091310
• Vendor Specific Advisory URL: http://www.microsoft.com/technet/security/advisory/2416728.mspx
  http://www.mono-project.com/Vulnerabilities#ASP.NET_Padding_Oracle
• News Article: http://www.theregister.co.uk/2010/09/14/web_apps_crypto_flaw/
  http://www.theregister.co.uk/2010/09/20/asp_dot_net_padding_oracle_fix/
  http://www.theregister.co.uk/2010/09/21/asp_dot_net_padding_oracle_fix/
  http://www.theregister.co.uk/2010/09/21/asp_dot_net_padding_oracle_fix/
  http://www.theregister.co.uk/2010/09/27/asp_dot_net_padding_oracle_fix/
• Microsoft Security Bulletin: ms10-070

• Juliano Rizzo
• Thai Duong