Microsoft .NET Framework Pointer Verification Remote Code Execution Vulnerability

Bugtraq ID:	36611
Class:	Input Validation Error
CVE:	CVE-2009-0090
Remote:	Yes
Local:	No
Published:	Oct 13 2009 12:00AM
Updated:	Oct 16 2009 11:18PM
Credit:	Pavel Minaev
Vulnerable:	Nortel Networks Symposium TAPI Service Provider 3.0 Nortel Networks Symposium Express Call Center (SECC) 4.2 Nortel Networks Symposium Express Call Center (SECC) Nortel Networks Symposium Agent 2.3 Nortel Networks Self-Service WVADS 0 Nortel Networks Self-Service VoiceXML 0 Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Workstation 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 500 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service MPS 100 0 Nortel Networks Self-Service CCXML 0 Nortel Networks Self-Service - CCSS7 0 Nortel Networks LinkPlexer 6.0 Nortel Networks Contact Center NCC 0 Nortel Networks Contact Center Multimedia & Outbound 7.0 Nortel Networks Contact Center Multimedia & Outbound 6.0 Nortel Networks Contact Center Multimedia Nortel Networks Contact Center Manager Server 6.0 Nortel Networks Contact Center Manager Server 0 Nortel Networks Contact Center Express Nortel Networks Contact Center Administration CCMA 7.0 Nortel Networks Contact Center Administration CCMA 6.0 Nortel Networks Contact Center - TAPI Server 0 Nortel Networks Contact Center - Symposium Agent 0 Nortel Networks Communication Control Toolkit 7.0 Nortel Networks Communication Control Toolkit 6.0 Nortel Networks Communication Control Toolkit 5.0 Nortel Networks CallPilot 703t Nortel Networks CallPilot 702t Nortel Networks CallPilot 201i Nortel Networks CallPilot 200i Nortel Networks CallPilot 1002rp Microsoft .NET Framework 2.0 SP1 Microsoft .NET Framework 1.1 SP1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.0 SP3 Microsoft .NET Framework 1.0 SP2 Microsoft .NET Framework 1.0 SP1 Microsoft .NET Framework 1.0
Not Vulnerable:

Microsoft .NET Framework Pointer Verification Remote Code Execution Vulnerability

The .NET Framework is prone to a remote code-execution vulnerability because it fails to properly verify .NET applications before running them.

Successful exploits may allow an attacker to execute arbitrary code with the privileges of the currently logged-in user. Failed attacks will cause denial-of-service conditions.

In a web hosting environment, attacker-supplied code will run with the privileges of the service account associated with the identity of the application pool that the malicious .NET application is running under.

Microsoft .NET Framework Pointer Verification Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft .NET Framework Pointer Verification Remote Code Execution Vulnerability

Solution:
The vendor has released updates and an advisory. Please see the references for details.


Microsoft .NET Framework 1.1 SP1

• Microsoft .NET Framework 1.1 Service Pack 1 CLR Security Update for Windows 2000, Windows XP, Windows 2003 Ser
  http://www.microsoft.com/downloads/details.aspx?familyid=78ac8b97-8327 -4ae1-8bb0-6cf227f3968f


• Microsoft .NET Framework 1.1 Service Pack 1 CLR Security Update for Windows 2003 Server x86 and Windows 2003 S
  http://www.microsoft.com/downloads/details.aspx?familyid=d1b4a58b-f0b1 -4400-a6e6-0255b0513bd1

Microsoft .NET Framework 1.0 SP3

• Microsoft .NET Framework 1.0 Service Pack 3 CLR Security Update for Windows XP Media Center Edition and Window
  http://www.microsoft.com/downloads/details.aspx?familyid=1bc56c26-1c7c -47e3-94f4-37af7e00392c

Microsoft .NET Framework 2.0 SP1

• Microsoft .NET Framework 2.0 Service Pack 1 CLR Security Update for Windows 2000, Windows Server 2003, and Win
  http://www.microsoft.com/downloads/details.aspx?familyid=d4a328b5-5470 -46b0-86c7-cfe0e6a3ea01


• Microsoft .NET Framework 2.0 Service Pack 1 CLR Security Update for Windows Vista
  http://www.microsoft.com/downloads/details.aspx?familyid=3cf329c6-6d3d -41eb-bb72-8ba241df0882


• Microsoft .NET Framework 2.0 Service Pack 1 CLR Security Update for Windows Vista Service Pack 1 and Windows S
  http://www.microsoft.com/downloads/details.aspx?familyid=30e5410d-0942 -4964-9037-52330488efda

Microsoft .NET Framework Pointer Verification Remote Code Execution Vulnerability

References:

• .NET Framework Homepage (Microsoft)
  
• Microsoft Homepage (Microsoft)
  
• MS09-061: More information about the .NET security bulletin (Microsoft)
  
• Nortel Enterprise Response to Microsoft Security Bulletin MS09-061 (Nortel Networks)
  
• Microsoft Security Bulletin MS09-061 (Microsoft)