PT-2016-1983 · Microsoft · .Net Framework

Published 2016-05-10 · Updated 2018-10-12 · CVE-2016-0149

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 SP2 through 4.6.1

Description The issue allows man-in-the-middle attackers to obtain sensitive cleartext information via vectors involving injection of cleartext data into the client-server data stream. An attacker who successfully exploited this vulnerability could decrypt encrypted SSL/TLS traffic by first injecting unencrypted data into the secure channel and then performing a man-in-the-middle attack between the targeted client and a legitimate server.

Recommendations For Microsoft .NET Framework versions 2.0 SP2 through 4.6.1, consider disabling the use of TLS/SSL protocol until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation. Avoid using the encryption component of Microsoft .NET Framework in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2016-01316

CVE-2016-0149

Affected Products

.Net Framework

References · 9

• https://bdu.fstec.ru/vul/2016-01316 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0149 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-065 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0149 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0149 · Vendor Advisory
• http://technet.microsoft.com/library/security/ms16-065 · Note
• http://securityfocus.com/bid/90026 · Note
• http://technet.microsoft.com/security/bulletin/MS16-065 · Note
• http://securitytracker.com/id/1035842 · Note