PT-2011-4442 · Microsoft · .Net Framework

Irene Abezgauz · Published 2011-12-29 · Updated 2023-12-07 · CVE-2011-3415

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 SP2 through 4.0

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted return URL. A spoofing vulnerability exists in the way that .NET Framework verifies return URLs during the forms authentication process, enabling an attacker to redirect a user to a website of their choice without the user's knowledge. This could lead to phishing attacks to gain information from the user. The vulnerability does not allow an attacker to execute code or elevate user rights directly but could be used to further compromise private user information.

Recommendations For Microsoft .NET Framework versions 2.0 SP2 through 4.0, update to a version that includes the fix for this issue to prevent potential phishing attacks. As a temporary workaround, consider restricting the use of the Forms Authentication feature until a patch is available. Avoid using crafted return URLs in the affected forms authentication process to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-3415

Affected Products

.Net Framework

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2011-3415 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3415 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-100 · Vendor Advisory
• http://jvn.jp/en/jp/JVN71256611/index.html · Note
• http://securityfocus.com/bid/51202 · Note
• http://jvndb.jvn.jp/jvndb/JVNDB-2011-003557 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14815 · Note
• http://technet.microsoft.com/en-us/security/bulletin/MS11-100 · Note