Vulnerability identifier: #VU2986

Vulnerability risk: High

CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2012-0162

CWE-ID: CWE-120

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Microsoft .NET Framework
Server applications / Frameworks for developing and running applications

Vendor: Microsoft

Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow. A remote attacker can create a specially crafted Web site containing a malicious XAML browser application (aka XBAP) or .NET Framework application, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Mitigation
Install update from vendor's website:

Microsoft .NET Framework 4 when installed on Windows XP Service Pack 3:
https://www.microsoft.com/downloads/details.aspx?familyid=4ee3cb61-542e-4e42-aa0e-0cbf8dd89648
Microsoft .NET Framework 4 when installed on Windows XP Professional x64 Edition Service Pack 2:
https://www.microsoft.com/downloads/details.aspx?familyid=4ee3cb61-542e-4e42-aa0e-0cbf8dd89648
Microsoft .NET Framework 4 when installed on Windows Server 2003 Service Pack 2:
https://www.microsoft.com/downloads/details.aspx?familyid=4ee3cb61-542e-4e42-aa0e-0cbf8dd89648
Microsoft .NET Framework 4 when installed on Windows Server 2003 x64 Edition Service Pack 2:
https://www.microsoft.com/downloads/details.aspx?familyid=4ee3cb61-542e-4e42-aa0e-0cbf8dd89648
Microsoft .NET Framework 4 when installed on Windows Vista Service Pack 2:
https://www.microsoft.com/downloads/details.aspx?familyid=4ee3cb61-542e-4e42-aa0e-0cbf8dd89648
Microsoft .NET Framework 4 when installed on Windows Vista x64 Edition Service Pack 2:
https://www.microsoft.com/downloads/details.aspx?familyid=4ee3cb61-542e-4e42-aa0e-0cbf8dd89648
Microsoft .NET Framework 4 when installed on Windows Server 2008 for 32-bit Systems Service Pack 2:
https://www.microsoft.com/downloads/details.aspx?familyid=4ee3cb61-542e-4e42-aa0e-0cbf8dd89648
Microsoft .NET Framework 4 when installed on Windows Server 2008 for x64-based Systems Service Pack 2:
https://www.microsoft.com/downloads/details.aspx?familyid=4ee3cb61-542e-4e42-aa0e-0cbf8dd89648
Microsoft .NET Framework 4 when installed on Windows 7 for 32-bit Systems:
https://www.microsoft.com/downloads/details.aspx?familyid=4ee3cb61-542e-4e42-aa0e-0cbf8dd89648
Microsoft .NET Framework 4 when installed on Windows 7 for 32-bit Systems Service Pack 1:
https://www.microsoft.com/downloads/details.aspx?familyid=4ee3cb61-542e-4e42-aa0e-0cbf8dd89648
Microsoft .NET Framework 4 when installed on Windows 7 for x64-based Systems:
https://www.microsoft.com/downloads/details.aspx?familyid=4ee3cb61-542e-4e42-aa0e-0cbf8dd89648
Microsoft .NET Framework 4 when installed on Windows 7 for x64-based Systems Service Pack 1:
https://www.microsoft.com/downloads/details.aspx?familyid=4ee3cb61-542e-4e42-aa0e-0cbf8dd89648
Microsoft .NET Framework 4 when installed on Windows Server 2008 R2 for x64-based Systems:
https://www.microsoft.com/downloads/details.aspx?familyid=4ee3cb61-542e-4e42-aa0e-0cbf8dd89648
Microsoft .NET Framework 4 when installed on Windows Server 2008 R2 for x64-based Systems Service Pack 1:
https://www.microsoft.com/downloads/details.aspx?familyid=4ee3cb61-542e-4e42-aa0e-0cbf8dd89648

Vulnerable software versions

Microsoft .NET Framework: 4.0

---

External links
http://technet.microsoft.com/en-us/library/security/ms12-034

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.