PT-2013-4695 · Microsoft · .Net Framework

Publicado 2013-10-09 · Atualizado 2018-10-12 · CVE-2013-3861

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5

Description A denial of service issue exists, allowing remote attackers to cause an application crash or hang via crafted character sequences in JSON data. This could enable an attacker to cause a server or application to crash or become unresponsive.

Recommendations For Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5, consider restricting the processing of JSON data from untrusted sources until a fix is available. As a temporary workaround, implement input validation to detect and prevent crafted character sequences in JSON data.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-3861

Produtos afetados

.Net Framework

Referências · 7

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3861 · Nota de Segurança
• http://us-cert.gov/ncas/alerts/TA13-288A · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3861 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18842 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-082 · Aviso do Fabricante
• http://technet.microsoft.com/en-us/security/bulletin/ms13-082 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-3861 · Nota de Segurança