PT-2011-2991 · Microsoft · Silverlight+1

Published 2011-10-11 · Updated 2023-12-07 · CVE-2011-1253

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4 Silverlight versions prior to 4.0.60831

Description A remote code execution issue exists due to improper restriction of inheritance within classes. This allows remote attackers to execute arbitrary code via crafted applications, including XAML browser applications, ASP.NET applications, .NET Framework applications, or Silverlight applications. An attacker who successfully exploits this issue could run arbitrary code in the security context of the logged-on user, potentially installing programs, viewing, changing, or deleting data, or creating new accounts with full user rights.

Recommendations For Microsoft .NET Framework versions 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4, update to a version that properly restricts class inheritance. For Silverlight versions prior to 4.0.60831, update to version 4.0.60831 or later to mitigate the risk of remote code execution.

Fix

RCE

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-1253

Affected Products

.Net Framework

Silverlight

References · 6

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1253 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-1253 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-078 · Vendor Advisory
• http://technet.microsoft.com/en-us/security/bulletin/MS11-078 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1253 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13069 · Note