PT-2013-4694 · Microsoft · .Net Framework

Publicado 2013-10-09 · Atualizado 2018-10-12 · CVE-2013-3860

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5

Description The issue is related to the improper parsing of a DTD during XML digital-signature validation, which can be exploited by remote attackers to cause a denial of service. This can result in an application crash or hang via a crafted signed XML document.

Recommendations For Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5, update to a version that properly handles DTD parsing during XML digital-signature validation to prevent denial of service attacks.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-3860

Produtos afetados

.Net Framework

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2013-3860 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3860 · Nota
• http://us-cert.gov/ncas/alerts/TA13-288A · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3860 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18517 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-082 · Aviso do Fabricante
• http://technet.microsoft.com/en-us/security/bulletin/ms13-082 · Nota