Vulnerabilities > CVE-2012-0015 - Code Injection vulnerability in Microsoft .Net Framework 2.0/3.5.1

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
microsoft
CWE-94
nessus
NVD
Published: 2012-02-14
Updated: 2024-11-21

Summary

Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly calculate the length of an unspecified buffer, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework Heap Corruption Vulnerability."

Vulnerable Configurations

Part Description Count
Application
Microsoft
2
OS
Microsoft
11

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Manipulating User-Controlled Variables
    This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

Msbulletin

bulletin_idMS12-016
bulletin_url
date2012-02-14T00:00:00
impactRemote Code Execution
knowledgebase_id2651026
knowledgebase_url
severityCritical
titleVulnerabilities in .NET Framework and Microsoft Silverlight Could Allow Remote Code Execution

Nessus

NASL familyWindows : Microsoft Bulletins
NASL idSMB_NT_MS12-016.NASL
descriptionThe version of the .NET Framework installed on the remote host reportedly is affected by the following vulnerabilities : - The .NET Framework and Silverlight do not properly use unmanaged objects, which could allow a malicious .NET Framework application to access memory in an unsafe manner. (CVE-2012-0014) - The .NET Framework does not properly calculate a buffer length when processing malicious input, which could lead to heap corruption. (CVE-2012-0015) An attacker may be able to leverage these vulnerabilities to execute arbitrary code on the affected system if a user on it can be tricked into viewing a specially crafted web page using a web browser that can run XAML Browser Applications (XBAPs) or Silverlight applications.
last seen2020-06-01
modified2020-06-02
plugin id57950
published2012-02-14
reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/57950
titleMS12-016: Vulnerabilities in .NET Framework and Microsoft Silverlight Could Allow Remote Code Execution (2651026)
code
#
# (C) Tenable Network Security, Inc.
#


include("compat.inc");


if (description)
{
  script_id(57950);
  script_version("1.18");
  script_cvs_date("Date: 2018/11/15 20:50:31");

  script_cve_id("CVE-2012-0014", "CVE-2012-0015");
  script_bugtraq_id(51938, 51940);
  script_xref(name:"MSFT", value:"MS12-016");
  script_xref(name:"MSKB", value: "2668562");
  script_xref(name:"MSKB", value: "2633869");
  script_xref(name:"MSKB", value: "2638804");
  script_xref(name:"MSKB", value: "2633870");
  script_xref(name:"MSKB", value: "2633873");
  script_xref(name:"MSKB", value: "2633879");
  script_xref(name:"MSKB", value: "2633877");
  script_xref(name:"MSKB", value: "2633874");
  script_xref(name:"MSKB", value: "2633880");

  script_name(english:"MS12-016: Vulnerabilities in .NET Framework and Microsoft Silverlight Could Allow Remote Code Execution (2651026)");
  script_summary(english:"Checks version of Silverlight.exe / system.dll");

  script_set_attribute(
    attribute:"synopsis",
    value:
"The .NET Framework install on the remote Windows host could allow
arbitrary code execution."
  );
  script_set_attribute(
    attribute:"description",
    value:
"The version of the .NET Framework installed on the remote host
reportedly is affected by the following vulnerabilities :

  - The .NET Framework and Silverlight do not properly use
    unmanaged objects, which could allow a malicious .NET
    Framework application to access memory in an unsafe
    manner. (CVE-2012-0014)

  - The .NET Framework does not properly calculate a buffer
    length when processing malicious input, which could
    lead to heap corruption. (CVE-2012-0015)

An attacker may be able to leverage these vulnerabilities to execute
arbitrary code on the affected system if a user on it can be tricked
into viewing a specially crafted web page using a web browser that can
run XAML Browser Applications (XBAPs) or Silverlight applications."
  );
  script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2012/ms12-016");
  script_set_attribute(
    attribute:"solution",
    value:
"Microsoft has released a set of patches for .NET Framework 2.0, 3.5.1,
and 4 as well as Silverlight 4."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2012/02/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2012/02/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/02/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:silverlight");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:.net_framework");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");

  script_dependencies("smb_hotfixes.nasl", "silverlight_detect.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, "Host/patch_management_checks");

  exit(0);
}


include("audit.inc");
include("smb_hotfixes_fcheck.inc");
include("smb_hotfixes.inc");
include("smb_func.inc");
include("misc_func.inc");


get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = 'MS12-016';
kbs = make_list(
  "2668562",
  "2633869",
  "2638804",
  "2633870",
  "2633873",
  "2633879",
  "2633877",
  "2633874",
  "2633880"
);
if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);

get_kb_item_or_exit("SMB/Registry/Enumerated");
get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);

if (hotfix_check_sp_range(xp:'3', win2003:'2', vista:'2', win7:'0,1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);

rootfile = hotfix_get_systemroot();
if (!rootfile) exit(1, "Failed to get the system root.");

share = hotfix_path2share(path:rootfile);
if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);


vuln = 0;

# Silverlight 4.x
ver = get_kb_item("SMB/Silverlight/Version");
fix = '4.1.10111';

if (!isnull(ver) && ver =~ '^4\\.' && ver_compare(ver:ver, fix:fix) == -1)
{
  path = get_kb_item("SMB/Silverlight/Path");
  report +=
    '\n  Product           : Microsoft Silverlight' +
    '\n  Path              : ' + path +
    '\n  Installed version : ' + ver +
    '\n  Fixed version     : ' + fix + '\n';
  hotfix_add_report(report, bulletin:bulletin, kb:"2668562");
  vuln++;
}

# .NET Framework 2.0 SP2 on Windows XP SP3 / Server 2003 SP2
missing = 0;
missing += hotfix_is_vulnerable(os:"5.1", sp:3, file:"System.dll", version:"2.0.50727.5704", min_version:"2.0.50727.5000", dir:"\Microsoft.NET\Framework\v2.0.50727");
missing += hotfix_is_vulnerable(os:"5.1", sp:3, file:"System.dll", version:"2.0.50727.3631", min_version:"2.0.50727.3000", dir:"\Microsoft.NET\Framework\v2.0.50727");
missing += hotfix_is_vulnerable(os:"5.2", sp:2, file:"System.dll", version:"2.0.50727.5704", min_version:"2.0.50727.5000", dir:"\Microsoft.NET\Framework\v2.0.50727");
missing += hotfix_is_vulnerable(os:"5.2", sp:2, file:"System.dll", version:"2.0.50727.3631", min_version:"2.0.50727.3000", dir:"\Microsoft.NET\Framework\v2.0.50727");

if (missing > 0) hotfix_add_report(bulletin:bulletin, kb:"2633880");
vuln += missing;

# .NET Framework 2.0 SP2 on Windows Vista SP2 / Server 2008 SP2
missing = 0;
missing += hotfix_is_vulnerable(os:"6.0", sp:2, file:"System.dll", version:"2.0.50727.5703", min_version:"2.0.50727.5000", dir:"\Microsoft.NET\Framework\v2.0.50727");
missing += hotfix_is_vulnerable(os:"6.0", sp:2, file:"System.dll", version:"2.0.50727.4220", min_version:"2.0.50727.4000", dir:"\Microsoft.NET\Framework\v2.0.50727");

if (missing > 0) hotfix_add_report(bulletin:bulletin, kb:"2633874");
vuln += missing;

# .NET Framework 3.5.1 on Windows 7 / Server 2008 R2
missing = 0;
missing += hotfix_is_vulnerable(os:"6.1", sp:0, file:"System.dll", version:"2.0.50727.5703", min_version:"2.0.50727.5000", dir:"\Microsoft.NET\Framework\v2.0.50727");
missing += hotfix_is_vulnerable(os:"6.1", sp:0, file:"System.dll", version:"2.0.50727.4968", min_version:"2.0.50727.4000", dir:"\Microsoft.NET\Framework\v2.0.50727");

if (missing > 0) hotfix_add_report(bulletin:bulletin, kb:"2633879");
vuln += missing;

# .NET Framework 3.5.1 on Windows 7 SP1 / Server 2008 R2 SP1
missing = 0;
missing += hotfix_is_vulnerable(os:"6.1", sp:1, file:"System.dll", version:"2.0.50727.5703", min_version:"2.0.50727.5600", dir:"\Microsoft.NET\Framework\v2.0.50727");
missing += hotfix_is_vulnerable(os:"6.1", sp:1, file:"System.dll", version:"2.0.50727.5453", min_version:"2.0.50727.5000", dir:"\Microsoft.NET\Framework\v2.0.50727");

if (missing > 0) hotfix_add_report(bulletin:bulletin, kb:"2633873");
vuln += missing;

# .NET Framework 4.0 on all supported versions of Windows
missing = 0;
missing += hotfix_is_vulnerable(os:"5.1", file:"System.dll", version:"4.0.30319.258", min_version:"4.0.30319.0",   dir:"\Microsoft.NET\Framework\v4.0.30319");
missing += hotfix_is_vulnerable(os:"5.1", file:"System.dll", version:"4.0.30319.523", min_version:"4.0.30319.400", dir:"\Microsoft.NET\Framework\v4.0.30319");
missing += hotfix_is_vulnerable(os:"5.2", file:"System.dll", version:"4.0.30319.258", min_version:"4.0.30319.0",   dir:"\Microsoft.NET\Framework\v4.0.30319");
missing += hotfix_is_vulnerable(os:"5.2", file:"System.dll", version:"4.0.30319.523", min_version:"4.0.30319.400", dir:"\Microsoft.NET\Framework\v4.0.30319");
missing += hotfix_is_vulnerable(os:"6.0", file:"System.dll", version:"4.0.30319.258", min_version:"4.0.30319.0",   dir:"\Microsoft.NET\Framework\v4.0.30319");
missing += hotfix_is_vulnerable(os:"6.0", file:"System.dll", version:"4.0.30319.523", min_version:"4.0.30319.400", dir:"\Microsoft.NET\Framework\v4.0.30319");
missing += hotfix_is_vulnerable(os:"6.1", file:"System.dll", version:"4.0.30319.258", min_version:"4.0.30319.0",   dir:"\Microsoft.NET\Framework\v4.0.30319");
missing += hotfix_is_vulnerable(os:"6.1", file:"System.dll", version:"4.0.30319.523", min_version:"4.0.30319.400", dir:"\Microsoft.NET\Framework\v4.0.30319");

if (missing > 0) hotfix_add_report(bulletin:bulletin, kb:"2633870");
vuln += missing;

# # .NET Framework 4.5 Developer Preview on Windows Vista, 2008, 7, and 2008 R2.
# missing = 0;
# missing += hotfix_is_vulnerable(os:"6.0", file:"System.dll", version:"4.0.30319.17081", min_version:"4.0.30319.10000", dir:"\Microsoft.NET\Framework\v4.0.30319");
# missing += hotfix_is_vulnerable(os:"6.0", file:"System.dll", version:"4.0.30319.17175", min_version:"4.0.30319.17000", dir:"\Microsoft.NET\Framework\v4.0.30319");
# missing += hotfix_is_vulnerable(os:"6.1", file:"System.dll", version:"4.0.30319.17081", min_version:"4.0.30319.10000", dir:"\Microsoft.NET\Framework\v4.0.30319");
# missing += hotfix_is_vulnerable(os:"6.1", file:"System.dll", version:"4.0.30319.17175", min_version:"4.0.30319.17000", dir:"\Microsoft.NET\Framework\v4.0.30319");
#
# if (missing > 0) hotfix_add_report(bulletin:bulletin, kb:"2638804");
# vuln += missing;

# nb: we're not covering here KBs 2633869 or 2633877 as they apply to
#     Windows Developer Preview (Windows 8).

if (vuln > 0)
{
  set_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
  hotfix_security_hole();
  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, 'affected');
}

Oval

accepted2014-08-18T04:01:04.689-04:00
classvulnerability
contributors
  • nameDragos Prisaca
    organizationSymantec Corporation
  • nameMaria Mikhno
    organizationALTX-SOFT
definition_extensions
  • commentMicrosoft Windows XP (32-bit) is installed
    ovaloval:org.mitre.oval:def:1353
  • commentMicrosoft Windows XP x64 is installed
    ovaloval:org.mitre.oval:def:15247
  • commentMicrosoft Windows Server 2003 (32-bit) is installed
    ovaloval:org.mitre.oval:def:1870
  • commentMicrosoft Windows Server 2003 (x64) is installed
    ovaloval:org.mitre.oval:def:730
  • commentMicrosoft Windows Server 2003 (ia64) Gold is installed
    ovaloval:org.mitre.oval:def:396
  • commentMicrosoft .NET Framework 2.0 Service Pack 2 is installed
    ovaloval:org.mitre.oval:def:6158
  • commentMicrosoft Windows Vista (32-bit) is installed
    ovaloval:org.mitre.oval:def:1282
  • commentMicrosoft Windows Vista x64 Edition is installed
    ovaloval:org.mitre.oval:def:2041
  • commentMicrosoft Windows Server 2008 (32-bit) is installed
    ovaloval:org.mitre.oval:def:4870
  • commentMicrosoft Windows Server 2008 (64-bit) is installed
    ovaloval:org.mitre.oval:def:5356
  • commentMicrosoft Windows Server 2008 (ia-64) is installed
    ovaloval:org.mitre.oval:def:5667
  • commentMicrosoft .NET Framework 2.0 Service Pack 2 is installed
    ovaloval:org.mitre.oval:def:6158
  • commentMicrosoft Windows 7 (32-bit) is installed
    ovaloval:org.mitre.oval:def:6165
  • commentMicrosoft Windows 7 x64 Edition is installed
    ovaloval:org.mitre.oval:def:5950
  • commentMicrosoft Windows Server 2008 R2 x64 Edition is installed
    ovaloval:org.mitre.oval:def:6438
  • commentMicrosoft Windows Server 2008 R2 Itanium-Based Edition is installed
    ovaloval:org.mitre.oval:def:5954
  • commentMicrosoft .NET Framework 3.5 SP1 is installed
    ovaloval:org.mitre.oval:def:12542
  • commentMicrosoft Windows 7 (32-bit) is installed
    ovaloval:org.mitre.oval:def:6165
  • commentMicrosoft Windows 7 x64 Edition is installed
    ovaloval:org.mitre.oval:def:5950
  • commentMicrosoft Windows Server 2008 R2 x64 Edition is installed
    ovaloval:org.mitre.oval:def:6438
  • commentMicrosoft Windows Server 2008 R2 Itanium-Based Edition is installed
    ovaloval:org.mitre.oval:def:5954
  • commentMicrosoft .NET Framework 3.5 SP1 is installed
    ovaloval:org.mitre.oval:def:12542
descriptionMicrosoft .NET Framework 2.0 SP2 and 3.5.1 does not properly calculate the length of an unspecified buffer, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework Heap Corruption Vulnerability."
familywindows
idoval:org.mitre.oval:def:14513
statusaccepted
submitted2012-02-14T13:00:00
title.NET Framework Heap Corruption Vulnerability
version40

References