- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Vulnerabilities in .NET Framework Allows Code Execution (MS07-040)
------------------------------------------------------------------------
SUMMARY
This update resolves three privately reported vulnerabilities. Two of
these vulnerabilities could allow remote code execution on client systems
with .NET Framework installed, and one could allow information disclosure
on Web servers running ASP.NET. In all remote code execution cases, users
whose accounts are configured to have fewer user rights on the system
could be less impacted than users who operate with administrative user
rights.
DETAILS
Vulnerable Systems:
Operating System - Component - Maximum Security Impact - Aggregate
Severity Rating - Bulletins Replaced by This Update
* Microsoft .NET Framework 1.0
* Windows 2000 Service Pack 4 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603> Microsoft .NET Framework 1.0 (KB928367) - Remote Code Execution - Critical - MS05-004
* Windows XP Service Pack 2 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603> Microsoft .NET Framework 1.0 (KB928367) - Remote Code Execution - Critical - MS05-004
* Windows XP Professional x64 Edition and Windows XP Professional x64
Edition Service Pack 2 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603> Microsoft .NET Framework 1.0 (KB928367) - Remote Code Execution - Critical - MS05-004
* Windows XP Tablet PC Edition 2005 and Windows XP Media Center Edition
2005 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=829A2C5B-11EC-4ED7-91AB-6961034147BC> Microsoft .NET Framework 1.0
(KB930494) - Remote Code Execution - Critical - MS05-004
* Windows Server 2003 Service Pack 1 and Windows Server 2003 Service
Pack 2 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603> Microsoft .NET Framework 1.0
(KB928367) - Remote Code Execution - Important - MS05-004
* Windows Server 2003 with SP1 for Itanium-based Systems and Windows
Server 2003 with SP2 for Itanium-based Systems -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603> Microsoft .NET Framework 1.0 (KB928367) - Remote Code Execution - Important - MS05-004
* Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition
Service Pack 2 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603> Microsoft .NET Framework 1.0 (KB928367) - Remote Code Execution - Important - MS05-004
* Windows Vista -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603> Microsoft .NET Framework 1.0 (KB928367) - Remote Code Execution - Important - MS05-004
* Microsoft .NET Framework 1.1
* Windows 2000 Service Pack 4 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=281FB2CD-C715-4F05-A01F-0455D2D9EBFB> Microsoft .NET Framework 1.1 (KB928366) - Remote Code Execution - Critical - MS05-004
* Windows XP Service Pack 2 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=281FB2CD-C715-4F05-A01F-0455D2D9EBFB> Microsoft .NET Framework 1.1 (KB928366) - Remote Code Execution - Critical - MS05-004
* Windows XP Professional x64 Edition and Windows XP Professional x64
Edition Service Pack 2 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=281FB2CD-C715-4F05-A01F-0455D2D9EBFB> Microsoft .NET Framework 1.1 (KB928366) - Remote Code Execution - Critical - MS05-004
* Windows Server 2003 Service Pack 1 and Windows Server 2003 Service
Pack 2 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=2495E656-1E0A-4B83-90DA-821E68067A71> Microsoft .NET Framework 1.1
(KB933854) - Remote Code Execution - Important - MS05-004
* Windows Server 2003 with SP1 for Itanium-based Systems and Windows
Server 2003 with SP2 for Itanium-based Systems -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=281FB2CD-C715-4F05-A01F-0455D2D9EBFB> Microsoft .NET Framework 1.1 (KB928366) - Remote Code Execution - Important - MS05-004
* Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition
Service Pack 2 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=281FB2CD-C715-4F05-A01F-0455D2D9EBFB> Microsoft .NET Framework 1.1 (KB928366) - Remote Code Execution - Important - MS05-004
* Windows Vista -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=7EEA368D-7B82-4583-8537-30351718A4E9> Microsoft .NET Framework 1.1 (KB929729) - Remote Code Execution - Important - MS05-004
* Windows Vista x64 Edition -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=7EEA368D-7B82-4583-8537-30351718A4E9> Microsoft .NET Framework 1.1 (KB929729) - Remote Code Execution - Important - MS05-004
* Microsoft .NET Framework 2.0
* Windows 2000 Service Pack 4 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=BA3CEB78-8E1B-4C38-ADFD-E8BC95AE548D> Microsoft .NET Framework 2.0 (KB928365) - Remote Code Execution - Critical - None
* Windows XP Service Pack 2 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=BA3CEB78-8E1B-4C38-ADFD-E8BC95AE548D> Microsoft .NET Framework 2.0 (KB928365) - Remote Code Execution - Critical - None
* Windows XP Professional x64 Edition and Windows XP Professional x64
Edition Service Pack 2 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=BA3CEB78-8E1B-4C38-ADFD-E8BC95AE548D> Microsoft .NET Framework 2.0 (KB928365) - Remote Code Execution - Critical - None
* Windows Server 2003 Service Pack 1 and Windows Server 2003 Service
Pack 2 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=BA3CEB78-8E1B-4C38-ADFD-E8BC95AE548D> Microsoft .NET Framework 2.0
(KB928365) - Remote Code Execution - Important - None
* Windows Server 2003 with SP1 for Itanium-based Systems and Windows
Server 2003 with SP2 for Itanium-based Systems -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=BA3CEB78-8E1B-4C38-ADFD-E8BC95AE548D> Microsoft .NET Framework 2.0 (KB928365) - Remote Code Execution - Important - None
* Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition
Service Pack 2 -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=BA3CEB78-8E1B-4C38-ADFD-E8BC95AE548D> Microsoft .NET Framework 2.0 (KB928365) - Remote Code Execution - Important - None
* Windows Vista -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=CBC9F3CF-C3C3-45C4-82E3-E11398BC2CD2> Microsoft .NET Framework 2.0 (KB929916) - Remote Code Execution - Important - None
* Windows Vista x64 Edition -
<http://www.microsoft.com/downloads/details.aspx?FamilyId=CBC9F3CF-C3C3-45C4-82E3-E11398BC2CD2> Microsoft .NET Framework 2.0 (KB929916) - Remote Code Execution - Important - None
Immune Systems:
* Windows XP Service Pack 2 - Microsoft .NET Framework 3.0
* Windows XP Professional x64 Edition and Windows XP Professional x64
Edition Service Pack 2 - Microsoft .NET Framework 3.0
* Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack
2 - Microsoft .NET Framework 3.0
* Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition
Service Pack 2 - Microsoft .NET Framework 3.0
* Windows Vista - Microsoft .NET Framework 3.0
* Windows Vista x64 Edition - Microsoft .NET Framework 3.0
NET PE Loader Vulnerability - CVE-2007-0041:
A remote code execution vulnerability exists in .NET Framework that could
allow an attacker who successfully exploited this vulnerability to make
changes to the system with the permissions of the logged-on user. If a
user is logged in with administrative user rights, an attacker could take
complete control of the affected system. An attacker could then install
programs; view, change, or delete data; or create new accounts with full
user rights. Users whose accounts are configured to have fewer user rights
on the system could be less impacted than users who operate with
administrative user rights.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0041>
CVE-2007-0041
ASP.NET Null Byte Termination Vulnerability - CVE-2007-0042:
An information disclosure vulnerability exists in .NET Framework that
could allow an attacker who successfully exploited this vulnerability to
bypass the security features of an ASP.NET Web site to download the
contents of any Web page.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0042>
CVE-2007-0042
NET JIT Compiler Vulnerability - CVE-2007-0043:
A remote code execution vulnerability exists in .NET Framework Just In
Time Compiler that could allow an attacker who successfully exploited this
vulnerability to make changes to the system with the permissions of the
logged-on user. If a user is logged on with administrative user rights, an
attacker could take complete control of the affected system. An attacker
could then install programs; view, change, or delete data; or create new
accounts with full user rights. Users whose accounts are configured to
have fewer user rights on the system could be less impacted than users who
operate with administrative user rights.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0043>
CVE-2007-0043
ADDITIONAL INFORMATION
The information has been provided by Microsoft Product Security.
The original article can be found at:
<http://www.microsoft.com/technet/security/bulletin/ms07-040.mspx>
http://www.microsoft.com/technet/security/bulletin/ms07-040.mspx
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
No comments:
Post a Comment