PT-2011-2541 · Microsoft · Silverlight+1

Published 2011-06-16 · Updated 2023-12-07 · CVE-2011-0664

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 SP1 through 4.0 Silverlight versions prior to 4.0.60531.0

Description The issue allows remote attackers to execute arbitrary code via crafted applications, including XAML browser applications, ASP.NET applications, .NET Framework applications, or Silverlight applications. This is due to improper validation of arguments to unspecified networking API functions. An attacker who successfully exploits this issue could run arbitrary code in the security context of the logged-on user, potentially installing programs, viewing, changing, or deleting data, or creating new accounts with full user rights.

Recommendations For Microsoft .NET Framework versions 2.0 SP1 through 4.0, update to a version that properly validates arguments to networking API functions. For Silverlight versions prior to 4.0.60531.0, update to version 4.0.60531.0 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-0664

Affected Products

.Net Framework

Silverlight

References · 6

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0664 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-039 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0664 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12105 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0664 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2011/MS11-039 · Note