PT-2009-2791 · Microsoft · .Net Framework

Jeroen Frijters · Published 2009-10-14 · Updated 2023-12-07 · CVE-2009-0091

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 through 3.5

Description A remote code execution issue exists due to the improper enforcement of a type-equality constraint in .NET verifiable code. This allows remote attackers to execute arbitrary code via crafted applications, including XAML browser applications (XBAP), ASP.NET applications, or .NET Framework applications. The issue can be exploited by a malicious Microsoft .NET application bypassing a type equality check, leading to arbitrary unmanaged code execution by casting an object of one type into another type.

Recommendations For Microsoft .NET Framework versions 2.0 through 3.5, update to a version that properly enforces type-equality constraints to prevent arbitrary code execution.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-0091

Affected Products

.Net Framework

References · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-061 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0091 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0091 · Security Note
• http://us-cert.gov/cas/techalerts/TA09-286A.html · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/ms09-061 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6451 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0091 · Note