PT-2010-4664 · Microsoft · .Net Framework

Jeroen Frijters · CVE-2010-3228 · Published 2010-10-13 · Updated 2023-12-07

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework version 4.0

Description A remote code execution issue exists in the Microsoft .NET Framework, specifically affecting the x64 and Itanium architectures. This is due to improper optimizations by the JIT compiler, allowing remote attackers to execute arbitrary code via a crafted .NET application that triggers memory corruption. The issue enables a specially crafted Microsoft .NET application to access memory in an unsafe manner, leading to arbitrary unmanaged code execution.

Recommendations For Microsoft .NET Framework version 4.0, update to a version that includes the fix for this issue to prevent arbitrary code execution.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2010-3228

Affected Products

.Net Framework

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2010-3228 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-077 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3228 · Security Note
• http://us-cert.gov/cas/techalerts/TA10-285A.html · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-077 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3228 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6824 · Note