PT-2014-1102 · Microsoft · .Net Framework

James Forshaw

·

Publicado

1999-01-01

·

Atualizado

2018-10-12

·

CVE-2014-1806

CVSS v2.0

10

Alta

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 1.1 SP1 through 4.5.1
Description The issue is related to the .NET Remoting implementation, which does not properly restrict memory access. This allows remote attackers to execute arbitrary code via vectors involving malformed objects. An elevation of privilege vulnerability exists in the way that .NET Framework handles TypeFilterLevel checks for some malformed objects, allowing attackers to elevate existing privileges.
Recommendations For Microsoft .NET Framework versions 1.1 SP1 through 4.5.1, consider restricting access to .NET Remoting until a patch is available. As a temporary workaround, consider disabling the TypeFilterLevel checks for malformed objects until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2014-00184
CVE-2014-1806
DOTNETREMOTINGCHECK

Produtos afetados

.Net Framework