PT-2015-2672 · Microsoft · .Net Framework

Publicado 2015-11-10 · Atualizado 2018-10-12 · CVE-2015-6115

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 SP2, 3.5, and 3.5.1

Description A security feature bypass exists in a .NET Framework component that does not properly implement the Address Space Layout Randomization (ASLR) security feature. This bypass could allow an attacker to load additional malicious code in an attempt to exploit another vulnerability. The ASLR bypass by itself does not allow arbitrary code execution, but it could be used in conjunction with another vulnerability to run arbitrary code. The issue can be exploited via a crafted web site.

Recommendations For Microsoft .NET Framework versions 2.0 SP2, 3.5, and 3.5.1, consider applying security updates or patches that properly implement the ASLR security feature to prevent bypassing of this protection mechanism. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2015-12037

CVE-2015-6115

Produtos afetados

.Net Framework

Referências · 8

• http://technet.microsoft.com/security/bulletin/MS15-118 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-118 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6115 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6115 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2015-6115 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/ms15-118 · Nota
• https://bdu.fstec.ru/vul/2015-12037 · Nota de Segurança
• http://securitytracker.com/id/1034116 · Nota