# MA-251.092010: MyCERT Alert - Vulnerability in ASP.NET Could Allow Information Disclose

**Date:** 20 Sep 2010  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-251.092010  
**Advisory ID:** MA-251.092010

---

**1.0 Introduction**
Microsoft is investigating a new public report vulnerability effecting ASP.NET (CVE-2010-3332). At this point of time, this vulnerability is still under investigation and there is no patch available. However, users can still apply the workarounds listed in section 4.0 if they must use ASP.NET.
**2.0 Impact**
An attacker who successfully exploits these vulnerabilities could read data, such as the View State, which was encrypted by the server. Note that this vulnerability would not allow an attacker to execute code or to elevate their user rights directly, but it could be used to produce useful information that could be used to try to further compromise the affected system.[1]
**3.0 Affected Products**
Below is the list of vulnerable products:
**4.0 Recommendation**
4.1 Enable ASP.NET custom errors, and map all error codes to the same error page.
Determine if you already have a web.config file in the root folder of each ASP.NET web application. You must have rights to create a file in the target directory to implement this workaround.
If the ASP.NET application does not have a web.config file:
**On .NET Framework 3.5 RTM and earlier**
1.Create a text file named **web.config** in the root folder of the ASP.NET application, and insert the following contents:
2. Create a text file named **error.html** containing a generic error message and save it in the root folder of the ASP.NET application.
3. Alternatively, you can rename error.html in the **web.config** file to point to an existing error page, but that page must display generic content, not context-specific content.
**On .NET Framework 3.5 Service Pack 1 and later**
1. Create a text file named **web.config** in the root folder of the ASP.NET application, and insert the following contents:
2. If you are comfortable using C#, we recommend using the following **ErrorPage.aspx** file:
3. If you are comfortable using Visual Basic .NET, we recommend using the following **ErrorPage.aspx** file:
If the ASP.NET application already has a **web.config** file:
**On .NET Framework 3.5 RTM and earlier**
1.Insert the bracketed text in the sample below into your existing **web.config** file:
2. Create a text file named **error.html** containing a generic error message and save it in the root folder of the ASP.NET application.
3. Alternatively, you can rename error.html in the **web.config** file to point to an existing error page, but that page must display generic content, not context-specific content.
**On .NET Framework 3.5 Service Pack 1 and later**
1. Insert the bracketed text in the sample below into your existing **web.config** file:
2. If you are comfortable using C#, we recommend using the following **ErrorPage.aspx** file:
3. If you are comfortable using Visual Basic .NET, we recommend using the following **ErrorPage.aspx** file:
**Impact of Workaround:** If an error occurs during a web transaction, the web clients will see the same generic error message on the server, regardless of what error actually occurs.
MyCERT advises users of the products mentioned in this advisory to keep themselves updated with the latest security announcements from the products' vendor. MyCERT can be reached through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#a4c9ddc7c1d6d0e4c9ddc7c1d6d08acbd6c38ac9dd)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT <EMAIL> <COMPLAINT> to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
i. <http://www.microsoft.com/technet/security/advisory/2416728.mspx>