Searching
..

Click anywhere to stop

KLA10603
Multiple vulnerabilities in Microsoft .NET Framework

Обновлено: 18/06/2020
Дата обнаружения
11/11/2014
Уровень угрозы
High
Описание

Multiple serious vulnerabilities have been found in Microsoft .NET Framework. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions fain privileges, execute arbitrary code or obtain sensitive information.

Below is a complete list of vulnerabilities

  1. An improper ASLR implementation can be exploited remotely via a specially designed web site or memory addresses prediction;
  2. Unverified data processing can be exploited remotely via vectors related to Internet Explorer;
  3. An improper hash table usage can be exploited remotely via a specially designed request;
  4. Improper TypeFilterLevel checking can be exploited remotely via .NET Remoting manipulations;
  5. Improper IRI parsing can be exploited remotely via a specially designed request;
  6. Unsafe method execution can be exploited remotely via a specially designed .NET application;
  7. Improper TCP connections handling can be exploited remotely via a specially designed HTTP requests;
  8. An improper memory access restrictions can be exploited remotely via vectors related to malformed objects.
Пораженные продукты

Microsoft .NET Framework version 1.0 Service Pack 3
Microsoft .NET Framework version 1.1 Service Pack 1
Microsoft .NET Framework version 2.0 Service Pack 2
Microsoft .NET Framework versions 3.5, 3.5.1, 4, 4.5, 4.5.1

Решение

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Первичный источник обнаружения
CVE-2014-4072
CVE-2014-0257
CVE-2014-0253
CVE-2014-0295
CVE-2014-4149
CVE-2014-4122
CVE-2014-4121
CVE-2014-4062
CVE-2014-4073
CVE-2014-1806
Оказываемое влияние
?
ACE 
[?]

DoS 
[?]

SB 
[?]

PE 
[?]
Связанные продукты
Microsoft .NET Framework
CVE-IDS
CVE-2014-40725.0Critical
CVE-2014-02579.3Critical
CVE-2014-02535.0Critical
CVE-2014-02954.3Warning
CVE-2014-41499.3Critical
CVE-2014-41224.3Warning
CVE-2014-40624.3Warning