PT-2009-2790 · Microsoft · .Net Framework

Pavel Minaev · Publicado 2009-10-14 · Atualizado 2023-12-07 · CVE-2009-0090

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 1.0 SP3 through 2.0 SP1

Description The issue allows remote attackers to obtain unintended access to stack memory and execute arbitrary code via crafted applications, including XAML browser applications, ASP.NET applications, or .NET Framework applications. A remote code execution vulnerability exists in the Microsoft .NET Framework, which could allow a malicious Microsoft .NET application to obtain a managed pointer to stack memory that is no longer used, leading to arbitrary unmanaged code execution.

Recommendations For Microsoft .NET Framework versions 1.0 SP3 through 2.0 SP1, update to a version that properly validates .NET verifiable code to prevent remote attackers from obtaining unintended access to stack memory. As a temporary workaround, consider restricting the execution of crafted .NET applications to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-0090

Produtos afetados

.Net Framework

Referências · 7

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5716 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0090 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-061 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-0090 · Nota de Segurança
• http://us-cert.gov/cas/techalerts/TA09-286A.html · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2009/ms09-061 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0090 · Nota de Segurança