PT-2017-10475 · Microsoft · .Net Framework

Published 2017-05-09 · Updated 2019-10-03 · CVE-2017-0248

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 through 4.7

Description A security issue exists where components do not completely validate certificates, allowing an attacker to present a certificate that is marked invalid for a specific use. The component may use it for that purpose, disregarding the Enhanced Key Usage taggings. This could enable an attacker to bypass security features.

Recommendations For Microsoft .NET Framework versions 2.0 through 4.7, ensure that all certificates are properly validated, considering their specific use and Enhanced Key Usage taggings. As a temporary workaround, consider restricting the use of certificates that are marked invalid for specific uses until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2017-0248

GHSA-CH6P-4JCM-H8VH

Affected Products

.Net Framework

References · 9

• https://osv.dev/vulnerability/GHSA-ch6p-4jcm-h8vh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0248 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0248 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-0248 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0248 · Security Note
• https://github.com/aspnet/Announcements/issues/239 · Note
• http://securityfocus.com/bid/98117 · Note
• https://github.com/advisories/GHSA-ch6p-4jcm-h8vh · Note
• http://securitytracker.com/id/1038458 · Note