Kaspersky LabKLA10768KLA10768 Security bypass vulnerability in Microsoft .NET Framework
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.017 Low
EPSS
Percentile
87.7%
Detect date:
03/08/2016
Severity:
High
Description:
An improper XML validation was found in Microsoft .NET Framework. By exploiting this vulnerability malicious users can bypass security restrictions. This vulnerability can be exploited remotely via signed XML file manipulations.
Affected products:
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1
Solution:
Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories:
Impacts:
SB
Related products:
Microsoft official advisories:
KB list:
3135996
3135985
3135987
3135995
3135984
3135983
3135982
3140768
3135991
3135989
3136000
3135998
3135988
3141780
3135994
3135997
3140745
References
support.microsoft.com/kb/3135982
support.microsoft.com/kb/3135983
support.microsoft.com/kb/3135984
support.microsoft.com/kb/3135985
support.microsoft.com/kb/3135987
support.microsoft.com/kb/3135988
support.microsoft.com/kb/3135989
support.microsoft.com/kb/3135991
support.microsoft.com/kb/3135994
support.microsoft.com/kb/3135995
support.microsoft.com/kb/3135996
support.microsoft.com/kb/3135997
support.microsoft.com/kb/3135998
support.microsoft.com/kb/3136000
support.microsoft.com/kb/3140745
support.microsoft.com/kb/3140768
support.microsoft.com/kb/3141780
portal.msrc.microsoft.com/en-us/security-guidance
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-0132
statistics.securelist.com/vulnerability-scan/month
threats.kaspersky.com/en/product/Microsoft-.NET-Framework/
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.017 Low
EPSS
Percentile
87.7%