PT-2009-2791 · Microsoft · .Net Framework

Jeroen Frijters · Publicado 2009-10-14 · Atualizado 2023-12-07 · CVE-2009-0091

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 through 3.5

Description A remote code execution issue exists due to the improper enforcement of a type-equality constraint in .NET verifiable code. This allows remote attackers to execute arbitrary code via crafted applications, including XAML browser applications (XBAP), ASP.NET applications, or .NET Framework applications. The issue can be exploited by a malicious Microsoft .NET application bypassing a type equality check, leading to arbitrary unmanaged code execution by casting an object of one type into another type.

Recommendations For Microsoft .NET Framework versions 2.0 through 3.5, update to a version that properly enforces type-equality constraints to prevent arbitrary code execution.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-0091

Produtos afetados

.Net Framework

Referências · 7

• http://us-cert.gov/cas/techalerts/TA09-286A.html · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-061 · Aviso do Fabricante
• https://docs.microsoft.com/security-updates/securitybulletins/2009/ms09-061 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6451 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0091 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0091 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0091 · Nota de Segurança