Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (2638420)

Publish date: March 07, 2013
  Severity: CRITICAL
  CVE Identifier: CVE-2011-3414,CVE-2011-3415,CVE-2011-3416,CVE-2011-3417
  Advisory Date: DEC 30, 2011

  DESCRIPTION

This security update addresses one publicly and three privately disclosed vulnerabilities in Microsoft .NET Framework. The most dangerous of these may lead to elevation of privilege if a potential attacker sends a maliciously crafted web request to the target. Successfully exploiting this system bug could also lead to execution of arbitrary command using an existing account on the ASP.NET site. To do this, an attacker must be registered to an account on the ASP.NET site and use an existing user credential.

  TREND MICRO PROTECTION INFORMATION

Trend Micro Deep Security shields the following vulnerabilities using the specified filter rules.

Bulletin ID Vulnerability ID Rule Number and Title Deep Security Pattern Version Deep Security Pattern Release Date
MS11-100 CVE-2011-3414 1004886 - Microsoft ASP.NET Hashes Denial Of Service Vulnerability (CVE-2011-3414) 11-036 Dec 30, 2011
MS11-100 CVE-2011-3415 1004887 - Microsoft ASP.NET Framework Forms Authentication URI Spoofing Vulnerability (CVE-2011-3415) 11-037 Dec 31, 2011
CVE-2011-3416 1000128 - HTTP Protocol Decoding 11-014 May 4, 2011

  AFFECTED SOFTWARE AND VERSION

  • Windows XP Service Pack 3 Microsoft .NET Framework 1.1 Service Pack 1
  • Windows XP Service Pack 3 Microsoft .NET Framework 2.0 Service Pack 2
  • Windows XP Service Pack 3 Microsoft .NET Framework 3.5 Service Pack 1
  • Windows XP Service Pack 3 Microsoft .NET Framework 4
  • Windows XP Professional x64 Edition Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
  • Windows XP Professional x64 Edition Service Pack 2 Microsoft .NET Framework 2.0 Service Pack 2
  • Windows XP Professional x64 Edition Service Pack 2 Microsoft .NET Framework 3.5 Service Pack 1
  • Windows XP Professional x64 Edition Service Pack 2 Microsoft .NET Framework 4
  • Windows Server 2003 Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
  • Windows Server 2003 Service Pack 2 Microsoft .NET Framework 2.0 Service Pack 2
  • Windows Server 2003 Service Pack 2 Microsoft .NET Framework 3.5 Service Pack 1
  • Windows Server 2003 Service Pack 2 Microsoft .NET Framework 4
  • Windows Server 2003 x64 Edition Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
  • Windows Server 2003 x64 Edition Service Pack 2 Microsoft .NET Framework 2.0 Service Pack 2
  • Windows Server 2003 x64 Edition Service Pack 2 Microsoft .NET Framework 3.5 Service Pack 1
  • Windows Server 2003 x64 Edition Service Pack 2 Microsoft .NET Framework 4
  • Windows Server 2003 with SP2 for Itanium-based Systems Microsoft .NET Framework 1.1 Service Pack 1
  • Windows Server 2003 with SP2 for Itanium-based Systems Microsoft .NET Framework 2.0 Service Pack 2
  • Windows Server 2003 with SP2 for Itanium-based Systems Microsoft .NET Framework 3.5 Service Pack 1
  • Windows Server 2003 with SP2 for Itanium-based Systems Microsoft .NET Framework 4
  • Windows Vista Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
  • Windows Vista Service Pack 2 Microsoft .NET Framework 2.0 Service Pack 2
  • Windows Vista Service Pack 2 Microsoft .NET Framework 3.5 Service Pack 1
  • Windows Vista Service Pack 2 Microsoft .NET Framework 4
  • Windows Vista x64 Edition Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
  • Windows Vista x64 Edition Service Pack 2 Microsoft .NET Framework 2.0 Service Pack 2
  • Windows Vista x64 Edition Service Pack 2 Microsoft .NET Framework 3.5 Service Pack 1
  • Windows Vista x64 Edition Service Pack 2 Microsoft .NET Framework 4
  • Windows Server 2008 for 32-bit Systems Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
  • Windows Server 2008 for 32-bit Systems Service Pack 2 Microsoft .NET Framework 2.0 Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 Microsoft .NET Framework 3.5 Service Pack 1
  • Windows Server 2008 for 32-bit Systems Service Pack 2 Microsoft .NET Framework 4
  • Microsoft .NET Framework 4 Microsoft .NET Framework 1.1 Service Pack 1
  • Microsoft .NET Framework 4 Microsoft .NET Framework 2.0 Service Pack 2
  • Microsoft .NET Framework 4 Microsoft .NET Framework 3.5 Service Pack 1
  • Microsoft .NET Framework 4 Microsoft .NET Framework 4
  • Windows Server 2008 for Itanium-based Systems Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
  • Windows Server 2008 for Itanium-based Systems Service Pack 2 Microsoft .NET Framework 2.0 Service Pack 2
  • Windows Server 2008 for Itanium-based Systems Service Pack 2 Microsoft .NET Framework 3.5 Service Pack 1
  • Windows Server 2008 for Itanium-based Systems Service Pack 2 Microsoft .NET Framework 4
  • Windows 7 for 32-bit Systems Microsoft .NET Framework 3.5.1
  • Windows 7 for 32-bit Systems Microsoft .NET Framework 4
  • Windows 7 for 32-bit Systems Service Pack 1 Microsoft .NET Framework 3.5 Service Pack 1
  • Windows 7 for 32-bit Systems Service Pack 1 Microsoft .NET Framework 4
  • Windows 7 for x64-based Systems Microsoft .NET Framework 3.5 Service Pack 1
  • Windows 7 for x64-based Systems Microsoft .NET Framework 4
  • Windows 7 for x64-based Systems Service Pack 1 Microsoft .NET Framework 3.5 Service Pack 1
  • Windows 7 for x64-based Systems Service Pack 1 Microsoft .NET Framework 4
  • Windows Server 2008 R2 for x64-based Systems Microsoft .NET Framework 3.5 Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Microsoft .NET Framework 4
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 Microsoft .NET Framework 3.5 Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 Microsoft .NET Framework 4
  • Windows Server 2008 R2 for Itanium-based Systems Microsoft .NET Framework 3.5 Service Pack 1
  • Windows Server 2008 R2 for Itanium-based Systems Microsoft .NET Framework 4
  • Windows Server 2008 R2 for Itanium-based Systems Service Pack 1 Microsoft .NET Framework 3.5 Service Pack 1
  • Windows Server 2008 R2 for Itanium-based Systems Service Pack 1 Microsoft .NET Framework 4

  OTHER INFORMATION

12 Security Predictions for 2012

Featured Stories