Microsoft .NET Framework Multiple Vulnerabilities

Last Update Date: 9 Jan 2013 15:09 Release Date: 9 Jan 2013 5199 Views

RISK: Medium Risk

TYPE: Operating Systems - Application Platforms

System Drawing Information Disclosure Vulnerability
An information disclosure vulnerability exists in the way the Windows Forms in .NET Framework handles pointers to unmanaged memory locations.
WinForms Buffer Overflow Vulnerability
An elevation of privilege vulnerability exists in the way that a Windows Forms method included in the .NET Framework validates the number of objects in memory before copying those objects into an array. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
S.DS.P Buffer Overflow Vulnerability
An elevation of privilege vulnerability exists in the way that a System.DirectoryServices.Protocols (S.DS.P) namespace method in the .NET Framework validates the size of objects in memory prior to copying those objects into an array. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Double Construction Vulnerability
An elevation of privilege vulnerability exists in the way that .NET Framework validates the permissions of certain objects in memory. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.