Microsoft .NET Framework Type Verification Remote Code Execution Vulnerability
BID:36617
Info
Microsoft .NET Framework Type Verification Remote Code Execution Vulnerability
| Bugtraq ID: | 36617 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-0091 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 13 2009 12:00AM |
| Updated: | Nov 02 2009 05:57PM |
| Credit: | Jeroen Frijters of Sumatra |
| Vulnerable: |
Nortel Networks Symposium TAPI Service Provider 3.0 Nortel Networks Symposium Express Call Center (SECC) 4.2 Nortel Networks Symposium Express Call Center (SECC) Nortel Networks Symposium Agent 2.3 Nortel Networks Self-Service WVADS 0 Nortel Networks Self-Service VoiceXML 0 Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Workstation 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 500 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service MPS 100 0 Nortel Networks Self-Service CCXML 0 Nortel Networks Self-Service - CCSS7 0 Nortel Networks LinkPlexer 6.0 Nortel Networks Contact Center NCC 0 Nortel Networks Contact Center Multimedia & Outbound 7.0 Nortel Networks Contact Center Multimedia & Outbound 6.0 Nortel Networks Contact Center Multimedia Nortel Networks Contact Center Manager Server 6.0 Nortel Networks Contact Center Manager Server 0 Nortel Networks Contact Center Express Nortel Networks Contact Center Administration CCMA 7.0 Nortel Networks Contact Center Administration CCMA 6.0 Nortel Networks Contact Center - TAPI Server 0 Nortel Networks Contact Center - Symposium Agent 0 Nortel Networks Communication Control Toolkit 7.0 Nortel Networks Communication Control Toolkit 6.0 Nortel Networks Communication Control Toolkit 5.0 Nortel Networks CallPilot 703t Nortel Networks CallPilot 702t Nortel Networks CallPilot 201i Nortel Networks CallPilot 200i Nortel Networks CallPilot 1002rp Microsoft .NET Framework 3.5 Microsoft .NET Framework 2.0 SP1 Microsoft .NET Framework 2.0 |
| Not Vulnerable: | |
Discussion
Microsoft .NET Framework Type Verification Remote Code Execution Vulnerability
The .NET Framework is prone to a remote code-execution vulnerability because it fails to properly verify .NET applications before running them.
Successful exploits may allow an attacker to execute arbitrary code with the privileges of the currently logged-in user. Failed attacks will cause denial-of-service conditions.
In a web hosting environment, attacker-supplied code will run with the privileges of the service account associated with the identity of the application pool that the malicious .NET application is running under.
The .NET Framework is prone to a remote code-execution vulnerability because it fails to properly verify .NET applications before running them.
Successful exploits may allow an attacker to execute arbitrary code with the privileges of the currently logged-in user. Failed attacks will cause denial-of-service conditions.
In a web hosting environment, attacker-supplied code will run with the privileges of the service account associated with the identity of the application pool that the malicious .NET application is running under.
Exploit / POC
Microsoft .NET Framework Type Verification Remote Code Execution Vulnerability
A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.
A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
Microsoft .NET Framework Type Verification Remote Code Execution Vulnerability
Solution:
The vendor has released updates and an advisory. Please see the references for details.
Microsoft .NET Framework 2.0
Microsoft .NET Framework 3.5
Microsoft .NET Framework 2.0 SP1
Solution:
The vendor has released updates and an advisory. Please see the references for details.
Microsoft .NET Framework 2.0
-
Microsoft .NET Framework 2.0 CLR Security Update for Windows Vista
http://www.microsoft.com/downloads/details.aspx?familyid=6f99521e-86b3 -4083-9132-e5ac06d40b63
Microsoft .NET Framework 3.5
-
Microsoft .NET Framework 2.0 Service Pack 1 CLR Security Update for Windows 2000, Windows Server 2003, and Win
http://www.microsoft.com/downloads/details.aspx?familyid=d4a328b5-5470 -46b0-86c7-cfe0e6a3ea01 -
Microsoft .NET Framework 2.0 Service Pack 1 CLR Security Update for Windows Vista
http://www.microsoft.com/downloads/details.aspx?familyid=3cf329c6-6d3d -41eb-bb72-8ba241df0882
Microsoft .NET Framework 2.0 SP1
-
Microsoft .NET Framework 2.0 Service Pack 1 CLR Security Update for Windows 2000, Windows Server 2003, and Win
http://www.microsoft.com/downloads/details.aspx?familyid=d4a328b5-5470 -46b0-86c7-cfe0e6a3ea01 -
Microsoft .NET Framework 2.0 Service Pack 1 CLR Security Update for Windows Vista
http://www.microsoft.com/downloads/details.aspx?familyid=3cf329c6-6d3d -41eb-bb72-8ba241df0882 -
Microsoft .NET Framework 2.0 Service Pack 1 CLR Security Update for Windows Vista Service Pack 1 and Windows S
http://www.microsoft.com/downloads/details.aspx?familyid=30e5410d-0942 -4964-9037-52330488efda
References
Microsoft .NET Framework Type Verification Remote Code Execution Vulnerability
References:
References:
- .NET Framework Homepage (Microsoft)
- Microsoft Homepage (Microsoft)
- MS09-061: More information about the .NET security bulletin (Microsoft)
- Nortel Enterprise Response to Microsoft Security Bulletin MS09-061 (Nortel Networks)
- Microsoft Security Bulletin MS09-061 (Microsoft)