PT-2015-5415 · Microsoft · .Net Framework

Publicado 2015-05-12 · Atualizado 2018-10-12 · CVE-2015-1672

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 SP2 through 4.5.2

Description A denial of service issue exists in Microsoft .NET Framework, allowing an unauthenticated attacker to degrade the performance of a .NET-enabled website and disrupt the availability of applications. This occurs when Microsoft .NET Framework attempts to decrypt certain specially crafted XML data, leading to recursion and performance degradation.

Recommendations For Microsoft .NET Framework versions 2.0 SP2 through 4.5.2, consider restricting the processing of encrypted XML data to minimize the risk of exploitation. As a temporary workaround, limit the recursion depth when decrypting XML data to prevent performance degradation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2015-1672

Produtos afetados

.Net Framework

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2015-1672 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/ms15-048 · Nota
• http://securityfocus.com/bid/74482 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1672 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-048 · Aviso do Fabricante
• http://securitytracker.com/id/1032297 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1672 · Nota de Segurança