Microsoft .NET Framework Chart Control Information Disclosure Vulnerability

Bugtraq ID:	48985
Class:	Design Error
CVE:	CVE-2011-1977
Remote:	Yes
Local:	No
Published:	Aug 09 2011 12:00AM
Updated:	Aug 12 2011 11:50AM
Credit:	Nico Leidecker and James Forshaw of Context Information Security.
Vulnerable:	Microsoft Chart Controls for .NET Framework 3.5 SP1 0 Microsoft .NET Framework 4.0
Not Vulnerable:

Microsoft .NET Framework Chart Control Information Disclosure Vulnerability

The Microsoft .NET Framework is prone to a remote information-disclosure vulnerability.

Attackers can exploit this issue to gain access to sensitive information that may aid in further attacks.

Attackers can exploit this issue by submitting a specially crafted request to a vulnerable ASP.NET server.

Microsoft .NET Framework Chart Control Information Disclosure Vulnerability

Attackers can use a browser to exploit this issue.

Microsoft .NET Framework Chart Control Information Disclosure Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.


Microsoft Chart Controls for .NET Framework 3.5 SP1 0

• Microsoft Security Update for Microsoft Chart Controls for Microsoft .NET Framework 3.5 Service Pack 1 (KB2500
  http://www.microsoft.com/downloads/en/details.aspx?familyid=8a80cc03-0 db9-4446-9ce6-159ad02cab52&displaylang=en

Microsoft .NET Framework 4.0

• Microsoft Security Update for Microsoft .NET Framework 4
  http://www.microsoft.com/downloads/en/details.aspx?familyid=6ca837f7-e da1-4ebe-b48a-8c77f949ebfd&displaylang=en

Microsoft .NET Framework Chart Control Information Disclosure Vulnerability

References:

• Context IS Advisory - MS11-066 .NET 4 - Microsoft Chart Control (Context IS)
  
• Microsoft Homepage (Microsoft)
  
• Vulnerability in Microsoft Chart Control Could Allow Information Disclosure (256 (Microsoft)