PT-2010-4664 · Microsoft · .Net Framework

Jeroen Frijters · Publicado 2010-10-13 · Atualizado 2023-12-07 · CVE-2010-3228

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework version 4.0

Description A remote code execution issue exists in the Microsoft .NET Framework, specifically affecting the x64 and Itanium architectures. This is due to improper optimizations by the JIT compiler, allowing remote attackers to execute arbitrary code via a crafted .NET application that triggers memory corruption. The issue enables a specially crafted Microsoft .NET application to access memory in an unsafe manner, leading to arbitrary unmanaged code execution.

Recommendations For Microsoft .NET Framework version 4.0, update to a version that includes the fix for this issue to prevent arbitrary code execution.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2010-3228

Produtos afetados

.Net Framework

Referências · 7

• http://us-cert.gov/cas/techalerts/TA10-285A.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3228 · Nota de Segurança
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-077 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3228 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6824 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-077 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3228 · Nota de Segurança