PT-2016-1983 · Microsoft · .Net Framework

Publicado 2016-05-10 · Atualizado 2018-10-12 · CVE-2016-0149

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 SP2 through 4.6.1

Description The issue allows man-in-the-middle attackers to obtain sensitive cleartext information via vectors involving injection of cleartext data into the client-server data stream. An attacker who successfully exploited this vulnerability could decrypt encrypted SSL/TLS traffic by first injecting unencrypted data into the secure channel and then performing a man-in-the-middle attack between the targeted client and a legitimate server.

Recommendations For Microsoft .NET Framework versions 2.0 SP2 through 4.6.1, consider disabling the use of TLS/SSL protocol until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation. Avoid using the encryption component of Microsoft .NET Framework in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2016-01316

CVE-2016-0149

Produtos afetados

.Net Framework

Referências · 9

• http://technet.microsoft.com/library/security/ms16-065 · Nota
• https://bdu.fstec.ru/vul/2016-01316 · Nota de Segurança
• http://securityfocus.com/bid/90026 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0149 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-065 · Aviso do Fabricante
• http://technet.microsoft.com/security/bulletin/MS16-065 · Nota
• http://securitytracker.com/id/1035842 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-0149 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-0149 · Aviso do Fabricante