PT-2016-1230 · Microsoft · .Net Framework

Published 2016-02-09 · Updated 2018-10-12 · CVE-2016-0047

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 SP2 through 4.6.1

Description The issue is related to the improper handling of icon data by Windows Forms (WinForms) in Microsoft .NET Framework, allowing remote attackers to obtain sensitive information from process memory. This is due to the lack of protection for internal data. An attacker could exploit this by sending specially crafted icon data to a .NET service, which could capture information and return it to the attacker within the icon's data.

Recommendations For Microsoft .NET Framework versions 2.0 SP2 through 4.6.1, consider restricting the handling of icon data in Windows Forms until a patch is available. As a temporary workaround, avoid using crafted icon data in .NET services to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2016-00491

CVE-2016-0047

Affected Products

.Net Framework

References · 8

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-019 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00491 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0047 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0047 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0047 · Security Note
• http://technet.microsoft.com/security/bulletin/MS16-019 · Note
• http://technet.microsoft.com/security/bulletin/ms16-019 · Note
• http://securitytracker.com/id/1034983 · Note