PT-2013-3092 · Microsoft · Windows Communication Foundation+1

Publicado 2013-05-14 · Atualizado 2018-10-12 · CVE-2013-1337

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework 4.5

Description A security feature bypass issue exists due to improper policy requirements creation for custom Windows Communication Foundation (WCF) endpoint authentication. This allows remote attackers to bypass authentication by sending queries to an endpoint, potentially giving them access to endpoint functions as if they were authenticated. This could enable an attacker to steal information or take actions in the context of an authenticated user.

Recommendations For Microsoft .NET Framework 4.5, consider restricting access to custom WCF endpoints until a proper fix is applied, and ensure that all authentication mechanisms are thoroughly reviewed and validated to prevent bypass attempts. As a temporary workaround, consider enhancing the authentication process for custom WCF endpoints to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2013-1337

Produtos afetados

.Net Framework

Windows Communication Foundation

Referências · 7

• http://us-cert.gov/ncas/alerts/TA13-134A · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16741 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-1337 · Nota de Segurança
• http://technet.microsoft.com/en-us/security/bulletin/ms13-040 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1337 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-040 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1337 · Nota