PT-2007-1535 · Microsoft · .Net Framework+1

Published 2007-07-10 · Updated 2018-10-30 · CVE-2007-0042

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 1.0 through 2.0

Description The issue is related to an interpretation conflict in ASP.NET within Microsoft .NET Framework, allowing remote attackers to access configuration files, obtain sensitive information, and possibly bypass security mechanisms. This is due to the different handling of %00 characters as a string terminator in POSIX functions and as a data character in .NET strings. An attacker could exploit this to download the contents of any Web page on an ASP.NET Web site, effectively bypassing its security features.

Recommendations For Microsoft .NET Framework versions 1.0 through 2.0, update to a version that includes the fix for this issue to prevent information disclosure and potential security mechanism bypass.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2007-0042

Affected Products

.Net Framework

Asp.Net

References · 13

• 🔥 https://exploit-db.com/exploits/30281 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0042 · Security Note
• http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0042 · Security Note
• http://secunia.com/advisories/26003 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-040 · Vendor Advisory
• http://securitytracker.com/id?1018356 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0042 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2007/ms07-040 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2070 · Note
• http://us-cert.gov/cas/techalerts/TA07-191A.html · Note
• http://security-assessment.com/files/advisories/2007-07-11_Multiple_.NET_Null_Byte_Injection_Vulnerabilities.pdf · Note
• http://vupen.com/english/advisories/2007/2482 · Note