PT-2006-2315 · Microsoft · Windows Xp+5

Urs Eichmann · Published 2006-07-11 · Updated 2018-10-12 · CVE-2006-1300

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft .NET framework 2.0 (ASP.NET) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1

Description This issue allows remote attackers to bypass access restrictions via unspecified "URL paths" that can access Application Folder objects explicitly by name. It could allow an attacker to bypass ASP.Net security and gain unauthorized access to objects in the Application folders, potentially producing useful information to further compromise the affected system. Note that this issue would not allow an attacker to execute code or to elevate their user rights directly.

Recommendations For Microsoft .NET framework 2.0 (ASP.NET) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, consider restricting access to Application Folder objects to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-1300

Affected Products

.Net Framework

Asp.Net

.Net Framework 2.0

Windows 2000

Windows Server 2003

Windows Xp

References · 15

• http://securitytracker.com/id?1016465 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-1300 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1300 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-033 · Vendor Advisory
• http://securityfocus.com/bid/18920 · Patch
• http://secunia.com/advisories/20999 · Note
• http://vupen.com/english/advisories/2006/2751 · Note
• http://frsirt.com/english/advisories/2006/2751 · Note
• http://xforce.iss.net/xforce/xfdb/26802 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1300 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2006/ms06-033 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26802 · Note
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:419 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A419 · Note
• http://osvdb.org/27153 · Note