Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (2638420)
Severity: CRITICAL
CVE Identifier: CVE-2011-3414,CVE-2011-3415,CVE-2011-3416,CVE-2011-3417
Advisory Date: DEC 30, 2011
DESCRIPTION
This security update addresses one publicly and three privately disclosed vulnerabilities in Microsoft .NET Framework. The most dangerous of these may lead to elevation of privilege if a potential attacker sends a maliciously crafted web request to the target. Successfully exploiting this system bug could also lead to execution of arbitrary command using an existing account on the ASP.NET site. To do this, an attacker must be registered to an account on the ASP.NET site and use an existing user credential.
TREND MICRO PROTECTION INFORMATION
Trend Micro Deep Security shields the following vulnerabilities using the specified filter rules.
| Bulletin ID | Vulnerability ID | Rule Number and Title | Deep Security Pattern Version | Deep Security Pattern Release Date |
|---|---|---|---|---|
| MS11-100 | CVE-2011-3414 | 1004886 - Microsoft ASP.NET Hashes Denial Of Service Vulnerability (CVE-2011-3414) | 11-036 | Dec 30, 2011 |
| MS11-100 | CVE-2011-3415 | 1004887 - Microsoft ASP.NET Framework Forms Authentication URI Spoofing Vulnerability (CVE-2011-3415) | 11-037 | Dec 31, 2011 |
| CVE-2011-3416 | 1000128 - HTTP Protocol Decoding | 11-014 | May 4, 2011 |
AFFECTED SOFTWARE AND VERSION
- Windows XP Service Pack 3 Microsoft .NET Framework 1.1 Service Pack 1
- Windows XP Service Pack 3 Microsoft .NET Framework 2.0 Service Pack 2
- Windows XP Service Pack 3 Microsoft .NET Framework 3.5 Service Pack 1
- Windows XP Service Pack 3 Microsoft .NET Framework 4
- Windows XP Professional x64 Edition Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
- Windows XP Professional x64 Edition Service Pack 2 Microsoft .NET Framework 2.0 Service Pack 2
- Windows XP Professional x64 Edition Service Pack 2 Microsoft .NET Framework 3.5 Service Pack 1
- Windows XP Professional x64 Edition Service Pack 2 Microsoft .NET Framework 4
- Windows Server 2003 Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
- Windows Server 2003 Service Pack 2 Microsoft .NET Framework 2.0 Service Pack 2
- Windows Server 2003 Service Pack 2 Microsoft .NET Framework 3.5 Service Pack 1
- Windows Server 2003 Service Pack 2 Microsoft .NET Framework 4
- Windows Server 2003 x64 Edition Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
- Windows Server 2003 x64 Edition Service Pack 2 Microsoft .NET Framework 2.0 Service Pack 2
- Windows Server 2003 x64 Edition Service Pack 2 Microsoft .NET Framework 3.5 Service Pack 1
- Windows Server 2003 x64 Edition Service Pack 2 Microsoft .NET Framework 4
- Windows Server 2003 with SP2 for Itanium-based Systems Microsoft .NET Framework 1.1 Service Pack 1
- Windows Server 2003 with SP2 for Itanium-based Systems Microsoft .NET Framework 2.0 Service Pack 2
- Windows Server 2003 with SP2 for Itanium-based Systems Microsoft .NET Framework 3.5 Service Pack 1
- Windows Server 2003 with SP2 for Itanium-based Systems Microsoft .NET Framework 4
- Windows Vista Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
- Windows Vista Service Pack 2 Microsoft .NET Framework 2.0 Service Pack 2
- Windows Vista Service Pack 2 Microsoft .NET Framework 3.5 Service Pack 1
- Windows Vista Service Pack 2 Microsoft .NET Framework 4
- Windows Vista x64 Edition Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
- Windows Vista x64 Edition Service Pack 2 Microsoft .NET Framework 2.0 Service Pack 2
- Windows Vista x64 Edition Service Pack 2 Microsoft .NET Framework 3.5 Service Pack 1
- Windows Vista x64 Edition Service Pack 2 Microsoft .NET Framework 4
- Windows Server 2008 for 32-bit Systems Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
- Windows Server 2008 for 32-bit Systems Service Pack 2 Microsoft .NET Framework 2.0 Service Pack 2
- Windows Server 2008 for 32-bit Systems Service Pack 2 Microsoft .NET Framework 3.5 Service Pack 1
- Windows Server 2008 for 32-bit Systems Service Pack 2 Microsoft .NET Framework 4
- Microsoft .NET Framework 4 Microsoft .NET Framework 1.1 Service Pack 1
- Microsoft .NET Framework 4 Microsoft .NET Framework 2.0 Service Pack 2
- Microsoft .NET Framework 4 Microsoft .NET Framework 3.5 Service Pack 1
- Microsoft .NET Framework 4 Microsoft .NET Framework 4
- Windows Server 2008 for Itanium-based Systems Service Pack 2 Microsoft .NET Framework 1.1 Service Pack 1
- Windows Server 2008 for Itanium-based Systems Service Pack 2 Microsoft .NET Framework 2.0 Service Pack 2
- Windows Server 2008 for Itanium-based Systems Service Pack 2 Microsoft .NET Framework 3.5 Service Pack 1
- Windows Server 2008 for Itanium-based Systems Service Pack 2 Microsoft .NET Framework 4
- Windows 7 for 32-bit Systems Microsoft .NET Framework 3.5.1
- Windows 7 for 32-bit Systems Microsoft .NET Framework 4
- Windows 7 for 32-bit Systems Service Pack 1 Microsoft .NET Framework 3.5 Service Pack 1
- Windows 7 for 32-bit Systems Service Pack 1 Microsoft .NET Framework 4
- Windows 7 for x64-based Systems Microsoft .NET Framework 3.5 Service Pack 1
- Windows 7 for x64-based Systems Microsoft .NET Framework 4
- Windows 7 for x64-based Systems Service Pack 1 Microsoft .NET Framework 3.5 Service Pack 1
- Windows 7 for x64-based Systems Service Pack 1 Microsoft .NET Framework 4
- Windows Server 2008 R2 for x64-based Systems Microsoft .NET Framework 3.5 Service Pack 1
- Windows Server 2008 R2 for x64-based Systems Microsoft .NET Framework 4
- Windows Server 2008 R2 for x64-based Systems Service Pack 1 Microsoft .NET Framework 3.5 Service Pack 1
- Windows Server 2008 R2 for x64-based Systems Service Pack 1 Microsoft .NET Framework 4
- Windows Server 2008 R2 for Itanium-based Systems Microsoft .NET Framework 3.5 Service Pack 1
- Windows Server 2008 R2 for Itanium-based Systems Microsoft .NET Framework 4
- Windows Server 2008 R2 for Itanium-based Systems Service Pack 1 Microsoft .NET Framework 3.5 Service Pack 1
- Windows Server 2008 R2 for Itanium-based Systems Service Pack 1 Microsoft .NET Framework 4
