PT-2012-3634 · Microsoft · .Net Framework

James Forshaw · Published 2012-11-13 · Updated 2023-12-07 · CVE-2012-1896

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 SP2 through 3.5.1

Description The issue is related to the improper consideration of trust levels during the construction of output data, allowing remote attackers to obtain sensitive information. This can be achieved through a crafted XAML browser application or a crafted .NET Framework application. The vulnerability is also described as an information disclosure issue due to the improper sanitization of output when a function is called from partially trusted code, which could allow an attacker to obtain confidential information contained on the target system.

Recommendations For Microsoft .NET Framework versions 2.0 SP2 through 3.5.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2012-1896

Affected Products

.Net Framework

References · 10

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-074 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1896 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-1896 · Security Note
• http://us-cert.gov/cas/techalerts/TA12-318A.html · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms12-074 · Note
• http://securitytracker.com/id?1027753 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1896 · Note
• http://secunia.com/advisories/51236 · Note
• http://securityfocus.com/bid/56456 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15785 · Note