Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."

The remote host is affected by the vulnerability described in GLSA-201206-13 (Mono: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mono and Mono debugger.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code, bypass general       constraints, obtain the source code for .aspx applications, obtain other       sensitive information, cause a Denial of Service, modify internal data       structures, or corrupt the internal state of the security manager.
    A local attacker could entice a user into running Mono debugger in a       directory containing a specially crafted library file to execute       arbitrary code with the privileges of the user running Mono debugger.
    A context-dependent attacker could bypass the authentication mechanism       provided by the XML Signature specification.
  Workaround :

    There is no known workaround at this time.

The FORMS authentication methods of mono ASP.net implementation were vulnerable to a padding oracle attack as described in CVE-2010-3332, as they did encryption after checksum.

This update changes the method to checksum after encryption to avoid this attack.

The following security bugs have been fixed :

  - Mono was vulnerable to a padding oracle attack.
    (CVE-2010-3332)

  - Mono loaded shared libraries from the current directory.
    (CVE-2010-4159)

By manipulating the padding on an encrypted string, Nessus was able to generate an error message that indicates a likely 'padding oracle' vulnerability.  Such a vulnerability can affect any application or framework that uses encryption improperly, such as some versions of ASP.net, Java Server Faces, and Mono. 

An attacker may exploit this issue to decrypt data and recover encryption keys, potentially viewing and modifying confidential data. 

Note that this plugin should detect the MS10-070 padding oracle vulnerability in ASP.net if CustomErrors are enabled in that.

There is an information disclosure vulnerability in ASP.NET, part of the .NET framework.  Information can be leaked due to improper error handling during encryption padding.

A remote attacker could exploit this to decrypt and modify an ASP.NET application's server-encrypted data.  In .NET Framework 3.5 SP1 and above, an attacker could exploit this to download any file within the ASP.NET application, including web.config.

ID	Name	Product	Family	Type	Severity
59651	GLSA-201206-13 : Mono: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
58408	SuSE 10 Security Update : Mono (ZYPP Patch Number 8001)	Nessus	SuSE Local Security Checks	Local	medium
53528	SuSE 11.1 Security Update : Mono (SAT Patch Number 4260)	Nessus	SuSE Local Security Checks	Local	medium
50413	CGI Generic Padding Oracle	Nessus	CGI abuses	Remote	medium
49806	MS10-070: Vulnerability in ASP.NET Could Allow Information Disclosure (2418042) (uncredentialed check)	Nessus	Windows	Remote	medium
49695	MS10-070: Vulnerability in ASP.NET Could Allow Information Disclosure (2418042)	Nessus	Windows : Microsoft Bulletins	Local	medium

Detections

Analytics

CVE-2010-3332

high

Tenable Plugins

high

medium

medium

medium

medium

medium