Microsoft .NET Framework JIT Compiler Optimization Remote Code Execution Vulnerability

Bugtraq ID:	43781
Class:	Unknown
CVE:	CVE-2010-3228
Remote:	Yes
Local:	No
Published:	Oct 12 2010 12:00AM
Updated:	Dec 14 2010 05:14PM
Credit:	Jeroen Frijters of Sumatra
Vulnerable:	Microsoft .NET Framework 4.0
Not Vulnerable:

Microsoft .NET Framework JIT Compiler Optimization Remote Code Execution Vulnerability

The Microsoft .NET Framework is prone to a remote code-execution vulnerability.

Successful exploits will allow the attacker to execute arbitrary code within the context of the currently logged-in user or the service account associated with an application pool identity. Failed exploit attempts will likely result in a denial-of-service condition.

The issue affects Microsoft .NET Framework 4.0 on x64-based and Itanium-based platforms.

Microsoft .NET Framework JIT Compiler Optimization Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft .NET Framework JIT Compiler Optimization Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for more information.


Microsoft .NET Framework 4.0

• Microsoft NDP40-KB2160841-IA64.exeNDP40-KB2160841-x64.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=bbc22169-996f -48d1-beed-0ee0dc4fbf4f

Microsoft .NET Framework JIT Compiler Optimization Remote Code Execution Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• Microsoft Security Bulletin MS10-077 (Microsoft)