PT-2015-5416 · Microsoft · Windows Forms+1

Published 2015-05-12 · Updated 2018-10-12 · CVE-2015-1673

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 1.1 SP1 through 4.5.2

Description The issue is caused by the improper handling of objects in memory by the Windows Forms (WinForms) libraries in Microsoft .NET Framework. This allows an attacker to potentially take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than those operating with administrative user rights.

Recommendations For Microsoft .NET Framework versions 1.1 SP1 through 4.5.2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-1673

Affected Products

.Net Framework

Windows Forms

References · 7

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1673 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-1673 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-048 · Vendor Advisory
• http://technet.microsoft.com/security/bulletin/ms15-048 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1673 · Note
• http://securityfocus.com/bid/74487 · Note
• http://securitytracker.com/id/1032297 · Note