PT-2012-3633 · Microsoft · .Net Framework

James Forshaw · Published 2012-11-13 · Updated 2023-12-07 · CVE-2012-1895

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 1.0 SP3 through 4

Description The issue arises from improper enforcement of object permissions in the reflection implementation, allowing remote attackers to execute arbitrary code. This can be achieved through a crafted XAML browser application or a crafted .NET Framework application. An elevation of privilege vulnerability exists in the way that .NET Framework validates the permissions of certain objects performing reflection. If exploited, an attacker could take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft .NET Framework versions 1.0 SP3 through 4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-1895

Affected Products

.Net Framework

References · 9

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1895 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-1895 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-074 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA12-318A.html · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms12-074 · Note
• http://securitytracker.com/id?1027753 · Note
• http://secunia.com/advisories/51236 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1895 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15924 · Note