PT-2015-5415 · Microsoft · .Net Framework

Published 2015-05-12 · Updated 2018-10-12 · CVE-2015-1672

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 SP2 through 4.5.2

Description A denial of service issue exists in Microsoft .NET Framework, allowing an unauthenticated attacker to degrade the performance of a .NET-enabled website and disrupt the availability of applications. This occurs when Microsoft .NET Framework attempts to decrypt certain specially crafted XML data, leading to recursion and performance degradation.

Recommendations For Microsoft .NET Framework versions 2.0 SP2 through 4.5.2, consider restricting the processing of encrypted XML data to minimize the risk of exploitation. As a temporary workaround, limit the recursion depth when decrypting XML data to prevent performance degradation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2015-1672

Affected Products

.Net Framework

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2015-1672 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-048 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1672 · Security Note
• http://technet.microsoft.com/security/bulletin/ms15-048 · Note
• http://securityfocus.com/bid/74482 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1672 · Note
• http://securitytracker.com/id/1032297 · Note