PT-2007-1535 · Microsoft · .Net Framework+1

Publicado 2007-07-10 · Atualizado 2018-10-30 · CVE-2007-0042

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 1.0 through 2.0

Description The issue is related to an interpretation conflict in ASP.NET within Microsoft .NET Framework, allowing remote attackers to access configuration files, obtain sensitive information, and possibly bypass security mechanisms. This is due to the different handling of %00 characters as a string terminator in POSIX functions and as a data character in .NET strings. An attacker could exploit this to download the contents of any Web page on an ASP.NET Web site, effectively bypassing its security features.

Recommendations For Microsoft .NET Framework versions 1.0 through 2.0, update to a version that includes the fix for this issue to prevent information disclosure and potential security mechanism bypass.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2007-0042

Produtos afetados

.Net Framework

Asp.Net

Referências · 13

• 🔥 https://exploit-db.com/exploits/30281 · Exploit
• http://securitytracker.com/id?1018356 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0042 · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2007/ms07-040 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2070 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0042 · Nota de Segurança
• http://us-cert.gov/cas/techalerts/TA07-191A.html · Nota
• http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-0042 · Nota de Segurança
• http://security-assessment.com/files/advisories/2007-07-11_Multiple_.NET_Null_Byte_Injection_Vulnerabilities.pdf · Nota
• http://secunia.com/advisories/26003 · Aviso do Fabricante
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-040 · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/2482 · Nota