PT-2016-2501 · Microsoft · .Net Framework

Published 2016-07-12 · Updated 2018-10-12 · CVE-2016-3255

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1

Description The issue is related to the improper parsing of XML input containing a reference to an external entity, allowing an attacker to read arbitrary files via an XML external entity declaration. This can be exploited by a remote attacker using XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Recommendations For Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1, consider restricting the use of XML external entities to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using XML input containing external entity declarations in conjunction with entity references. Restrict access to sensitive files that could be read through this issue to minimize the risk of information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2016-01892

CVE-2016-3255

Affected Products

.Net Framework

References · 9

• https://osv.dev/vulnerability/CVE-2016-3255 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01892 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-3255 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3255 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-091 · Vendor Advisory
• http://technet.microsoft.com/library/security/ms16-091 · Note
• http://securityfocus.com/bid/91601 · Note
• http://securitytracker.com/id/1036291 · Note
• http://technet.microsoft.com/security/bulletin/MS16-091 · Note