PT-2012-4076 · Microsoft · .Net Framework

Publicado 2012-11-13 · Atualizado 2023-12-07 · CVE-2012-2519

Positive Technologies (AI Summary)

CVSS v2.0

7.9

Alta

Vetor base

AV:A/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 1.0 SP3 through 4

Description The issue allows local users to gain privileges via a Trojan horse DLL in the current working directory. A remote code execution vulnerability exists in the way that the Microsoft .NET Framework handles the loading of DLL files. An attacker who successfully exploited this vulnerability could take complete control of an affected system, then install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft .NET Framework versions 1.0 SP3 through 4, update to a version that is not affected by this issue to prevent exploitation. As a temporary workaround, consider restricting the loading of DLL files from untrusted locations to minimize the risk of exploitation. Avoid executing .NET applications from directories that may contain malicious DLLs until the issue is resolved.

Correção

Identificadores relacionados

CVE-2012-2519

Produtos afetados

.Net Framework

Referências · 9

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2519 · Nota
• http://us-cert.gov/cas/techalerts/TA12-318A.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15520 · Nota
• http://technet.microsoft.com/en-us/security/bulletin/ms12-074 · Nota
• http://securitytracker.com/id?1027753 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2519 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-074 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2519 · Nota de Segurança
• http://secunia.com/advisories/51236 · Nota