Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in

Microsoft .NET Framework Multiple Vulnerabilities (2916607)

🗓️ 12 Feb 2014 00:00:00Reported by Copyright (C) 2014 Greenbone AGType 
openvas
 openvas🔗 plugins.openvas.org👁 97 Views

Microsoft .NET Framework Multiple Vulnerabilities (2916607) including ASP.NET improper connection handling, .NET framework error with COM objects, and unspecified weakness; impact on all versions from 1.0 to 4.5.1

Related
Refs
Code
ReporterTitlePublishedViews
Family
zdt
zdt		MS14-009 .NET Deployment Service IE Sandbox Escape Exploit
27 Jun 201400:00
–zdt
bdu_fstec
BDU FSTEC		The vulnerability of the Microsoft .NET Framework software platform allows a malicious individual to execute arbitrary code.
5 Jul 201600:00
–bdu_fstec
bdu_fstec
BDU FSTEC		The vulnerability in Microsoft.NET Framework software allows a malicious attacker to compromise the accessibility of protected information.
6 Jul 201600:00
–bdu_fstec
bdu_fstec
BDU FSTEC		The vulnerability in Microsoft.NET Framework software allows a malicious attacker to compromise the confidentiality, integrity, and accessibility of protected information.
6 Jul 201600:00
–bdu_fstec
circl
Circl		CVE-2014-0253
19 Jun 202616:45
–circl
circl
Circl		CVE-2014-0257
27 Jun 201400:00
–circl
circl
Circl		CVE-2014-0295
19 Jun 202616:45
–circl
checkpoint_advisories
Check Point Advisories		Microsoft ASP.NET POST Request Denial of Service (MS14-009; CVE-2014-0253)
11 Mar 201400:00
–checkpoint_advisories
cve
CVE		CVE-2014-0253
12 Feb 201402:00
–cve
cve
CVE		CVE-2014-0257
12 Feb 201402:00
–cve
Rows per page
# SPDX-FileCopyrightText: 2014 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.903337");
  script_version("2026-04-28T06:28:06+0000");
  script_cve_id("CVE-2014-0253", "CVE-2014-0257", "CVE-2014-0295");
  script_tag(name:"cvss_base", value:"9.3");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_tag(name:"last_modification", value:"2026-04-28 06:28:06 +0000 (Tue, 28 Apr 2026)");
  script_tag(name:"creation_date", value:"2014-02-12 10:37:08 +0530 (Wed, 12 Feb 2014)");
  script_name("Microsoft .NET Framework Multiple Vulnerabilities (2916607)");

  script_tag(name:"summary", value:"This host is missing an important security update according to
  Microsoft Bulletin MS14-009.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"Multiple flaws due to:

  - ASP.NET does not properly identify stale HTTP connections.

  - An error within the .NET framework when handling certain COM objects.

  - Additionally, some unspecified weakness exists.");

  script_tag(name:"impact", value:"Successful exploitation could allow an attacker to bypass certain security
  mechanism and cause denial of service.");

  script_tag(name:"affected", value:"Microsoft .NET Framework 1.0, 1.1, 2.0, 3.0, 3.5, 3.5.1, 4.0, 4.5 and 4.5.1.");

  script_tag(name:"solution", value:"The vendor has released updates. Please see the references for more information.");

  script_tag(name:"qod_type", value:"executable_version");
  script_tag(name:"solution_type", value:"VendorFix");

  script_xref(name:"URL", value:"http://support.microsoft.com/kb/2916607");
  script_xref(name:"URL", value:"http://www.securityfocus.com/bid/65415");
  script_xref(name:"URL", value:"http://www.securityfocus.com/bid/65417");
  script_xref(name:"URL", value:"http://www.securityfocus.com/bid/65418");
  script_xref(name:"URL", value:"https://technet.microsoft.com/en-us/security/bulletin/ms14-009");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2014 Greenbone AG");
  script_family("Windows : Microsoft Bulletins");
  script_dependencies("smb_reg_service_pack.nasl");
  script_require_ports(139, 445);
  script_mandatory_keys("SMB/WindowsVersion");

  exit(0);
}

include("smb_nt.inc");
include("secpod_reg.inc");
include("version_func.inc");
include("secpod_smb_func.inc");

if(hotfix_check_sp(xp:4, xpx64:3, win2003:3, win2003x64:3, winVista:3, win7:2,
                   win7x64:2, win2008:3, win2008r2:2, win8:1, win8x64:1, win8_1:1, win8_1x64:1, win2012:1) <= 0){
  exit(0);
}

key = "SOFTWARE\Microsoft\ASP.NET\";
if(!registry_key_exists(key:key)){
  exit(0);
}

foreach item (registry_enum_keys(key:key))
{
  path = registry_get_sz(key:key + item, item:"Path");
  if(path && "\Microsoft.NET\Framework" >< path)
  {
    dllVer = fetch_file_version(sysPath:path, file_name:"mscorlib.dll");
    if(dllVer)
    {
      ## .NET Framework 1.1 Service Pack 1 for Windows Server 2003 Service Pack 2
      if((hotfix_check_sp(win2003:3, win2003x64:3) > 0) &&
         (version_in_range(version:dllVer, test_version:"1.1.4322.2000", test_version2:"1.1.4322.2503")))
      {
        VULN1 = TRUE;
        Vulnerable_range = "1.1.4322.2000 - 1.1.4322.2503";
      }

      ## .NET Framework 2.0 Service Pack 2 for Windows XP Service Pack 3 and Windows Server 2003 Service Pack 2
      if(hotfix_check_sp(xp:4, xpx64:3, win2003:3, win2003x64:3) > 0)
      {
        if(version_in_range(version:dllVer, test_version:"2.0.50727.3000", test_version2:"2.0.50727.3654"))
        {
          VULN1 = TRUE;
          Vulnerable_range = "2.0.50727.3000 - 2.0.50727.3654";
        }

        else if(version_in_range(version:dllVer, test_version:"2.0.50727.7000", test_version2:"2.0.50727.7040"))
        {
          VULN1 = TRUE;
          Vulnerable_range = "2.0.50727.7000 - 2.0.50727.7040";
        }
      }

      ## .NET Framework 2.0 Service Pack 2 for Windows Vista Service Pack 2 and Windows Server 2008 Service Pack 2
      if(hotfix_check_sp(winVista:3, win2008:3) > 0)
      {
        if(version_in_range(version:dllVer, test_version:"2.0.50727.4000", test_version2:"2.0.50727.4246"))
        {
          VULN1 = TRUE;
          Vulnerable_range = "2.0.50727.4000 - 2.0.50727.4246";
        }

        else if(version_in_range(version:dllVer, test_version:"2.0.50727.7000", test_version2:"2.0.50727.7040"))
        {
          VULN1 = TRUE;
          Vulnerable_range = "2.0.50727.7000 - 2.0.50727.7040";
        }
      }

      ## .NET Framework 3.5 for Windows 8 and Windows Server 2012
      if(hotfix_check_sp(win8:1, win8x64:1, win2012:1) > 0)
      {
        if(version_in_range(version:dllVer, test_version:"2.0.50727.6000", test_version2:"2.0.50727.6412"))
        {
          VULN1 = TRUE;
          Vulnerable_range = "2.0.50727.6000 - 2.0.50727.6412";
        }
        else if(version_in_range(version:dllVer, test_version:"2.0.50727.7000", test_version2:"2.0.50727.7040"))
        {
          VULN1 = TRUE;
          Vulnerable_range = "2.0.50727.7000 - 2.0.50727.7040";
        }
      }

      ## .NET Framework 3.5 for Windows 8.1
      if((hotfix_check_sp(win8_1:1, win8_1x64:1) > 0) &&
         (version_is_less(version:dllVer, test_version:"2.0.50727.8000")))
      {
        VULN1 = TRUE;
        Vulnerable_range = "Less than 2.0.50727.8000";
      }

      ## .NET Framework 3.5.1 for Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1
      if(hotfix_check_sp(win7:2, win7x64:2, win2008r2:2) > 0)
      {
        if(version_in_range(version:dllVer, test_version:"2.0.50727.5400", test_version2:"2.0.50727.5476"))
        {
          VULN1 = TRUE;
          Vulnerable_range = "2.0.50727.5400 - 2.0.50727.5476";
        }
        else if(version_in_range(version:dllVer, test_version:"2.0.50727.7000", test_version2:"2.0.50727.7040"))
        {
          VULN1 = TRUE;
          Vulnerable_range = "2.0.50727.7000 - 2.0.50727.7040";
        }
      }

      ## .NET Framework 4 on Windows XP, Windows Server 2003, Windows Vista,
      if(hotfix_check_sp(xp:4, xpx64:3, win2003:3, winVista:3, win2008:3, win7:2, win7x64:2, win2008r2:2) > 0)
      {
        if(version_in_range(version:dllVer, test_version:"4.0.30319.1000", test_version2:"4.0.30319.1021"))
        {
          VULN1 = TRUE;
          Vulnerable_range = "4.0.30319.1000 - 4.0.30319.1021";
        }
        else if(version_in_range(version:dllVer, test_version:"4.0.30319.2000", test_version2:"4.0.30319.2033"))
        {
          VULN1 = TRUE;
          Vulnerable_range = "4.0.30319.2000 - 4.0.30319.2033";
        }
      }
      ## .NET Framework 4.5 for Windows Vista Service Pack 2, Windows Server 2008 Service Pack 2
      if(hotfix_check_sp(win7:2, win7x64:2, win2008r2:2, winVista:3, win2008:3) > 0)
      {
        if(version_in_range(version:dllVer, test_version:"4.0.30319.18000", test_version2:"4.0.30319.18062"))
        {
          VULN1 = TRUE;
          Vulnerable_range = "4.0.30319.18000 - 4.0.30319.18062";
        }
        if(version_in_range(version:dllVer, test_version:"4.0.30319.19000", test_version2:"4.0.30319.19131"))
        {
          VULN1 = TRUE;
          Vulnerable_range = "4.0.30319.19000 - 4.0.30319.19131";
        }
      }

      ## .NET Framework 4.5 for Windows 8 and Windows Server 2012
      if(hotfix_check_sp(win8:1, win8x64:1, win2012:1) > 0)
      {
        if(version_in_range(version:dllVer, test_version:"4.0.30319.18000", test_version2:"4.0.30319.18448"))
        {
          VULN1 = TRUE;
          Vulnerable_range = "4.0.30319.18000 - 4.0.30319.18448";
        }
        if(version_in_range(version:dllVer, test_version:"4.0.30319.19000", test_version2:"4.0.30319.19454"))
        {
          VULN1 = TRUE;
          Vulnerable_range = "4.0.30319.19000 - 4.0.30319.19454";
        }
      }

      ## .NET Framework 4.5.1 for Windows Vista Service Pack 2, Windows Server 2008 Service Pack 2
      if((hotfix_check_sp(win7:2, win7x64:2, win2008r2:2, winVista:3, win2008:3) > 0) &&
         (version_in_range(version:dllVer, test_version:"4.0.30319.18000", test_version2:"4.0.30319.18443")))
      {
        VULN1 = TRUE;
        Vulnerable_range = "4.0.30319.18000 - 4.0.30319.18443";
      }

      ## .NET Framework 4.5.1 for Windows 8 and Windows Server 2012
      if((hotfix_check_sp(win8:1, win8x64:1, win2012:1) > 0) &&
         (version_in_range(version:dllVer, test_version:"4.0.30319.18000", test_version2:"4.0.30319.18448")))
      {
        VULN1 = TRUE;
        Vulnerable_range = "4.0.30319.18000 - 4.0.30319.18448";
      }

      ## .NET Framework 4.5.1 for Windows 8.1
      if(hotfix_check_sp(win8_1:1, win8_1x64:1) > 0)
      {
        if(version_in_range(version:dllVer, test_version:"4.0.30319.34000", test_version2:"4.0.30319.34010"))
        {
          VULN1 = TRUE;
          Vulnerable_range = "4.0.30319.34000 - 4.0.30319.34010";
        }
        else if(version_in_range(version:dllVer, test_version:"4.0.30319.36000", test_version2:"4.0.30319.36012"))
        {
          VULN1 = TRUE;
          Vulnerable_range = "4.0.30319.36000 - 4.0.30319.36012";
        }
      }
    } ## mscorlib.dll - END



    dllVer = fetch_file_version(sysPath:path, file_name:"System.Web.dll");
    if(dllVer)
    {
      ## .NET Framework 1.1 Service Pack 1 for Windows Server 2003 Service Pack 2
      if((hotfix_check_sp(win2003:3, win2003x64:3) > 0) &&
        (version_in_range(version:dllVer, test_version:"1.1.4322.2000", test_version2:"1.1.4322.2504")))
      {
        VULN2 = TRUE;
        Vulnerable_range = "1.1.4322.2000 - 1.1.4322.2504";
      }

      ## .NET Framework 2.0 Service Pack 2 for Windows XP Service Pack 3 and Windows Server 2003 Service Pack 2
      if(hotfix_check_sp(xp:4, xpx64:3, win2003:3, win2003x64:3) > 0)
      {
        if(version_in_range(version:dllVer, test_version:"2.0.50727.3000", test_version2:"2.0.50727.3657"))
        {
          VULN2 = TRUE;
          Vulnerable_range = "2.0.50727.3000 - 2.0.50727.3657";
        }

        else if(version_in_range(version:dllVer, test_version:"2.0.50727.7000", test_version2:"2.0.50727.7045"))
        {
          VULN2 = TRUE;
          Vulnerable_range = "2.0.50727.7000 - 2.0.50727.7045";
        }
      }
      ## .NET Framework 2.0 Service Pack 2 for Windows Vista Service Pack 2 and Windows Server 2008 Service Pack 2
      if(hotfix_check_sp(winVista:3, win2008:3) > 0)
      {
        if(version_in_range(version:dllVer, test_version:"2.0.50727.4000", test_version2:"2.0.50727.4247"))
        {
          VULN2 = TRUE;
          Vulnerable_range = "2.0.50727.4000 - 2.0.50727.4247";
        }
        else if(version_in_range(version:dllVer, test_version:"2.0.50727.7000", test_version2:"2.0.50727.7044"))
        {
          VULN2 = TRUE;
          Vulnerable_range = "2.0.50727.7000 - 2.0.50727.7044";
        }
      }

      ## .NET Framework 3.5 for Windows 8 and Windows Server 2012
      if(hotfix_check_sp(win8:1, win2012:1) > 0)
      {
        if(version_in_range(version:dllVer, test_version:"2.0.50727.6000", test_version2:"2.0.50727.6413"))
        {
          VULN2 = TRUE;
          Vulnerable_range = "2.0.50727.6000 - 2.0.50727.6413";
        }
        else if(version_in_range(version:dllVer, test_version:"2.0.50727.7000", test_version2:"2.0.50727.7044"))
        {
          VULN2 = TRUE;
          Vulnerable_range = "2.0.50727.7000 - 2.0.50727.7044";
        }
      }

      ## .NET Framework 3.5 for Windows 8.1
      if((hotfix_check_sp(win8_1:1, win8_1x64:1) > 0) &&
         (version_is_less(version:dllVer, test_version:"2.0.50727.8001")))
      {
        VULN2 = TRUE;
        Vulnerable_range = "Less than 2.0.50727.8001";
      }

      ## .NET Framework 3.5.1 for Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1
      if(hotfix_check_sp(win7:2, win7x64:2, win2008r2:2) > 0)
      {
        if(version_in_range(version:dllVer, test_version:"2.0.50727.5400", test_version2:"2.0.50727.5478"))
        {
          VULN2 = TRUE;
          Vulnerable_range = "2.0.50727.5400 - 2.0.50727.5478";
        }
        else if(version_in_range(version:dllVer, test_version:"2.0.50727.7000", test_version2:"2.0.50727.7044"))
        {
          VULN2 = TRUE;
          Vulnerable_range = "2.0.50727.7000 - 2.0.50727.7044";
        }
      }

      ## .NET Framework 4 on Windows XP, Windows Server 2003, Windows Vista,
      if(hotfix_check_sp(xp:4, xpx64:3, win2003:3, winVista:3, win2008:3, win7:2, win7x64:2, win2008r2:2) > 0)
      {
        if(version_in_range(version:dllVer, test_version:"4.0.30319.1000", test_version2:"4.0.30319.1021"))
        {
          VULN2 = TRUE;
          Vulnerable_range = "4.0.30319.1000 - 4.0.30319.1021";
        }
        if(version_in_range(version:dllVer, test_version:"4.0.30319.2000", test_version2:"4.0.30319.2033"))
        {
          VULN2 = TRUE;
          Vulnerable_range = "4.0.30319.2000 - 4.0.30319.2033";
        }
      }
      ## .NET Framework 4.5 for Windows Vista Service Pack 2, Windows Server 2008 Service Pack 2
      if(hotfix_check_sp(win7:2, win7x64:2, win2008r2:2, winVista:3, win2008:3) > 0)
      {
        if(version_in_range(version:dllVer, test_version:"4.0.30319.18000", test_version2:"4.0.30319.18066"))
        {
          VULN2 = TRUE;
          Vulnerable_range = "4.0.30319.18000 - 4.0.30319.18066";
        }
        if(version_in_range(version:dllVer, test_version:"4.0.30319.19000", test_version2:"4.0.30319.19135"))
        {
          VULN2 = TRUE;
          Vulnerable_range = "4.0.30319.19000 - 4.0.30319.19135";
        }
      }
      ## .NET Framework 4.5 for Windows 8 and Windows Server 2012
      if(hotfix_check_sp(win8:1, win8x64:1, win2012:1) > 0)
      {
        if(version_in_range(version:dllVer, test_version:"4.0.30319.18000", test_version2:"4.0.30319.18448"))
        {
          VULN2 = TRUE;
          Vulnerable_range = "4.0.30319.18000 - 4.0.30319.18448";
        }
        if(version_in_range(version:dllVer, test_version:"4.0.30319.19000", test_version2:"4.0.30319.19454"))
        {
          VULN2 = TRUE;
          Vulnerable_range = "4.0.30319.19000 - 4.0.30319.19454";
        }
      }

      ## .NET Framework 4.5.1 for Windows Vista Service Pack 2, Windows Server 2008 Service Pack 2
      if((hotfix_check_sp(win7:2, win7x64:2, win2008r2:2, winVista:3, win2008:3) > 0) &&
         (version_in_range(version:dllVer, test_version:"4.0.30319.18000", test_version2:"4.0.30319.18445")))
      {
        VULN2 = TRUE;
        Vulnerable_range = "4.0.30319.18000 - 4.0.30319.18445";
      }

      ## .NET Framework 4.5.1 for Windows 8 and Windows Server 2012
      if((hotfix_check_sp(win8:1, win8x64:1, win2012:1) > 0) &&
         (version_in_range(version:dllVer, test_version:"4.0.30319.18000", test_version2:"4.0.30319.18446")))
      {
        VULN2 = TRUE;
        Vulnerable_range = "4.0.30319.18000 - 4.0.30319.18446";
      }

      ## .NET Framework 4.5.1 for Windows 8.1
      if((hotfix_check_sp(win8_1:1, win8_1x64:1) > 0) &&
         (version_in_range(version:dllVer, test_version:"4.0.30319.34000", test_version2:"4.0.30319.34008")))
      {
        VULN2 = TRUE;
        Vulnerable_range = "4.0.30319.34000 - 4.0.30319.34008";
      }

    } ## System.Web.dll - END



    dllVer = fetch_file_version(sysPath:path, file_name:"vsavb7rt.dll");
    if(dllVer)
    {
      ## .NET Framework 2.0 Service Pack 2 for Windows Vista Service Pack 2 and Windows Server 2008 Service Pack 2
      if(hotfix_check_sp(winVista:3, win2008:3) > 0)
      {
        if(version_in_range(version:dllVer, test_version:"8.0.50727.4000", test_version2:"8.0.50727.4249"))
        {
          VULN3 = TRUE;
          Vulnerable_range = "8.0.50727.4000 - 8.0.50727.4249";
        }
        else if(version_in_range(version:dllVer, test_version:"8.0.50727.7000", test_version2:"8.0.50727.7050"))
        {
          VULN3 = TRUE;
          Vulnerable_range = "8.0.50727.7000 - 8.0.50727.7050";
        }
      }
      ## .NET Framework 3.5.1 for Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1
      if(hotfix_check_sp(win7:2, win7x64:2, win2008r2:2) > 0)
      {
        if(version_in_range(version:dllVer, test_version:"8.0.50727.5400", test_version2:"8.0.50727.5480"))
        {
          VULN3 = TRUE;
          Vulnerable_range = "8.0.50727.5400 - 8.0.50727.5480";
        }
        if(version_in_range(version:dllVer, test_version:"8.0.50727.7000", test_version2:"8.0.50727.7050"))
        {
          VULN3 = TRUE;
          Vulnerable_range = "8.0.50727.7000 - 8.0.50727.7050";
        }
      }

    } ## vsavb7rt.dll - END

  }
}

if(VULN1)
{
  report = 'File checked:     ' + path + "\mscorlib.dll" + '\n' +
           'File version:     ' + dllVer + '\n' +
           'Vulnerable range: ' + Vulnerable_range+ '\n' ;
  security_message(data:report);
}

if(VULN2)
{
  report = 'File checked:     ' + path + "\System.Web.dll" + '\n' +
           'File version:     ' + dllVer + '\n' +
           'Vulnerable range: ' + Vulnerable_range+ '\n' ;
  security_message(data:report);
}

if(VULN3)
{
  report = 'File checked:     ' + path + "\vsavb7rt.dll" + '\n' +
           'File version:     ' + dllVer + '\n' +
           'Vulnerable range: ' + Vulnerable_range+ '\n' ;
  security_message(data:report);
  exit(0);
}

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
28 Apr 2026 00:00Current
7.2High risk
Vulners AI Score7.2
CVSS 29.3
EPSS0.69686
microsoft .net frameworkasp.netcom objectsvulnerabilitysecurity updatedenial of service
97