PT-2013-2056 · Microsoft · .Net Framework+3

Published 2013-01-09 · Updated 2023-12-07 · CVE-2013-0005

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 3.5 through 4 Management OData IIS Extension on Windows Server 2012

Description A denial of service issue exists in the OData protocol implementation, allowing remote attackers to cause a denial of service via crafted values in HTTP requests. This could cause the server or service to stop responding and restart.

Recommendations For Microsoft .NET Framework versions 3.5 through 4, update to a version that includes the fix for this issue. For Management OData IIS Extension on Windows Server 2012, restrict access to the OData endpoint to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling the WCF Replace function in the Open Data protocol implementation until a patch is available.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-0005

Affected Products

.Net Framework

Management Odata Iis Extension

Wcf

Windows Server 2012

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2013-0005 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-007 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0005 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16282 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms13-007 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0005 · Note
• http://us-cert.gov/cas/techalerts/TA13-008A.html · Note