PT-2013-4694 · Microsoft · .Net Framework

Published 2013-10-09 · Updated 2018-10-12 · CVE-2013-3860

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5

Description The issue is related to the improper parsing of a DTD during XML digital-signature validation, which can be exploited by remote attackers to cause a denial of service. This can result in an application crash or hang via a crafted signed XML document.

Recommendations For Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5, update to a version that properly handles DTD parsing during XML digital-signature validation to prevent denial of service attacks.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-3860

Affected Products

.Net Framework

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2013-3860 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3860 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-082 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3860 · Note
• http://us-cert.gov/ncas/alerts/TA13-288A · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18517 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms13-082 · Note