Signature Detail
Short Name |
HTTP:MS-DOT-NET-XAML-RCE |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Microsoft .NET Framework XAML Browser Applications Stack Corruption |
Release Date |
2013/01/09 |
Update Number |
2223 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Microsoft .NET Framework XAML Browser Applications Stack Corruption
This signature detects attempts to exploit a known vulnerability against Microsoft .NET Framework. It is due to memory corruption when handling method calls that take structures with misaligned fields as parameters. Remote attackers could exploit this vulnerability by either enticing target users to visit a malicious web page containing an XBAP (XAML browser application), or by uploading an ASP.NET application to a vulnerable server. Successful exploitation could result in execution of arbitrary code within the security context of the currently logged on user. An unsuccessful exploit attempt may terminate the PresentationHost.exe .NET component.
Extended Description
The x86 JIT compiler in Microsoft .NET Framework 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 does not properly compile function calls, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework Stack Corruption Vulnerability."
Affected Products
- microsoft .net_framework 2.0 (sp2)
- microsoft .net_framework 3.5.1
- microsoft .net_framework 3.5 (sp1)
- microsoft .net_framework 4.0
References
- CVE: CVE-2010-3958