PT-2016-1230 · Microsoft · .Net Framework

Publicado 2016-02-09 · Atualizado 2018-10-12 · CVE-2016-0047

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 SP2 through 4.6.1

Description The issue is related to the improper handling of icon data by Windows Forms (WinForms) in Microsoft .NET Framework, allowing remote attackers to obtain sensitive information from process memory. This is due to the lack of protection for internal data. An attacker could exploit this by sending specially crafted icon data to a .NET service, which could capture information and return it to the attacker within the icon's data.

Recommendations For Microsoft .NET Framework versions 2.0 SP2 through 4.6.1, consider restricting the handling of icon data in Windows Forms until a patch is available. As a temporary workaround, avoid using crafted icon data in .NET services to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2016-00491

CVE-2016-0047

Produtos afetados

.Net Framework

Referências · 8

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-019 · Aviso do Fabricante
• http://technet.microsoft.com/security/bulletin/MS16-019 · Nota
• https://bdu.fstec.ru/vul/2016-00491 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/ms16-019 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0047 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-0047 · Aviso do Fabricante
• http://securitytracker.com/id/1034983 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-0047 · Nota de Segurança