PT-2017-10475 · Microsoft · .Net Framework

Publicado 2017-05-09 · Atualizado 2019-10-03 · CVE-2017-0248

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 through 4.7

Description A security issue exists where components do not completely validate certificates, allowing an attacker to present a certificate that is marked invalid for a specific use. The component may use it for that purpose, disregarding the Enhanced Key Usage taggings. This could enable an attacker to bypass security features.

Recommendations For Microsoft .NET Framework versions 2.0 through 4.7, ensure that all certificates are properly validated, considering their specific use and Enhanced Key Usage taggings. As a temporary workaround, consider restricting the use of certificates that are marked invalid for specific uses until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2017-0248

GHSA-CH6P-4JCM-H8VH

Produtos afetados

.Net Framework

Referências · 9

• https://github.com/aspnet/Announcements/issues/239 · Nota
• http://securityfocus.com/bid/98117 · Nota
• https://osv.dev/vulnerability/GHSA-ch6p-4jcm-h8vh · Aviso do Fabricante
• https://github.com/advisories/GHSA-ch6p-4jcm-h8vh · Nota
• http://securitytracker.com/id/1038458 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-0248 · Nota de Segurança
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0248 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-0248 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0248 · Nota de Segurança