CVE-2013-0004
9.3
Vector
AV:N/AC:M/Au:N/C:C/I:C/A:C
Exploitability: 8.6 / Impact: 10.0
Source: NVD
Description
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate the permissions of objects in memory, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Double Construction Vulnerability."
Affected (7)
Products: Microsoft: .net Framework
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Version 1.0 sp3 |
| Running on/with | Platform Versions |
|---|---|
Microsoft Windows Xp | All versions |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Version 1.1 sp1 |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| Version 2.0 sp2 |
Configuration D
| Vulnerable Software | Affected Versions |
|---|---|
| Version 4.0 |
| Running on/with | Platform Versions |
|---|---|
Microsoft Windows Server 2003 | All versions |
Microsoft Windows Server 2008 | All versions |
Microsoft Windows Xp | All versions |
Configuration E
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.5 |
Configuration F
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.5.1 |
| Running on/with | Platform Versions |
|---|---|
Microsoft Windows 7 | All versions |
Microsoft Windows Server 2008 | All versions |
Configuration G
| Vulnerable Software | Affected Versions |
|---|---|
| Version 4.5 |
| Running on/with | Platform Versions |
|---|---|
Microsoft Windows 7 | All versions |
Microsoft Windows 8 | All versions |
Microsoft Windows Rt | All versions |
Microsoft Windows Server 2012 | All versions |
Microsoft Windows Vista | All versions |
References (6)
Source: secure@microsoft.com
US Government Resource
Source: secure@microsoft.com
Source: secure@microsoft.com
Source: af854a3a-2127-422b-91ae-364da2661108
US Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Timeline
No history available yet.