CVE-2012-0163 Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate function parameters, which allows remote attackers to execute arbitrary code via (1) a crafted XAM...
HighCVSS 9.3
EPSS 38.3%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate function parameters, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework Parameter Validation Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft net framework | = 1.0-sp3 | No fix listed |
| Microsoft net framework | = 1.1-sp1 | No fix listed |
| Microsoft net framework | = 2.0-sp2 | No fix listed |
| Microsoft net framework | = 3.5 | No fix listed |
| Microsoft net framework | = 3.5.1 | No fix listed |
| Microsoft net framework | = 4.0 | No fix listed |
| Microsoft net framework | = 4.5 | No fix listed |
References
- 1026907 vdb-entry
- TA12-101A third-party-advisory us-government-resource
- MS12-025 vendor-advisory
- ms-dotnet-parameter-code-exec(74377) vdb-entry
- oval:org.mitre.oval:def:15495 signature vdb-entry