|
|
|
|
| |
Credit:
The information has been provided by Microsoft Product Security.
The original article can be found at: http://www.microsoft.com/technet/security/bulletin/ms07-040.mspx
|
| |
Vulnerable Systems:
Operating System - Component - Maximum Security Impact - Aggregate Severity Rating - Bulletins Replaced by This Update
* Microsoft .NET Framework 1.0
* Windows 2000 Service Pack 4 - Microsoft .NET Framework 1.0 (KB928367) - Remote Code Execution - Critical - MS05-004
* Windows XP Service Pack 2 - Microsoft .NET Framework 1.0 (KB928367) - Remote Code Execution - Critical - MS05-004
* Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2 - Microsoft .NET Framework 1.0 (KB928367) - Remote Code Execution - Critical - MS05-004
* Windows XP Tablet PC Edition 2005 and Windows XP Media Center Edition 2005 - Microsoft .NET Framework 1.0
(KB930494) - Remote Code Execution - Critical - MS05-004
* Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 - Microsoft .NET Framework 1.0
(KB928367) - Remote Code Execution - Important - MS05-004
* Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems - Microsoft .NET Framework 1.0 (KB928367) - Remote Code Execution - Important - MS05-004
* Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2 - Microsoft .NET Framework 1.0 (KB928367) - Remote Code Execution - Important - MS05-004
* Windows Vista - Microsoft .NET Framework 1.0 (KB928367) - Remote Code Execution - Important - MS05-004
* Microsoft .NET Framework 1.1
* Windows 2000 Service Pack 4 - Microsoft .NET Framework 1.1 (KB928366) - Remote Code Execution - Critical - MS05-004
* Windows XP Service Pack 2 - Microsoft .NET Framework 1.1 (KB928366) - Remote Code Execution - Critical - MS05-004
* Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2 - Microsoft .NET Framework 1.1 (KB928366) - Remote Code Execution - Critical - MS05-004
* Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 - Microsoft .NET Framework 1.1
(KB933854) - Remote Code Execution - Important - MS05-004
* Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems - Microsoft .NET Framework 1.1 (KB928366) - Remote Code Execution - Important - MS05-004
* Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2 - Microsoft .NET Framework 1.1 (KB928366) - Remote Code Execution - Important - MS05-004
* Windows Vista - Microsoft .NET Framework 1.1 (KB929729) - Remote Code Execution - Important - MS05-004
* Windows Vista x64 Edition - Microsoft .NET Framework 1.1 (KB929729) - Remote Code Execution - Important - MS05-004
* Microsoft .NET Framework 2.0
* Windows 2000 Service Pack 4 - Microsoft .NET Framework 2.0 (KB928365) - Remote Code Execution - Critical - None
* Windows XP Service Pack 2 - Microsoft .NET Framework 2.0 (KB928365) - Remote Code Execution - Critical - None
* Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2 - Microsoft .NET Framework 2.0 (KB928365) - Remote Code Execution - Critical - None
* Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 - Microsoft .NET Framework 2.0
(KB928365) - Remote Code Execution - Important - None
* Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems - Microsoft .NET Framework 2.0 (KB928365) - Remote Code Execution - Important - None
* Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2 - Microsoft .NET Framework 2.0 (KB928365) - Remote Code Execution - Important - None
* Windows Vista - Microsoft .NET Framework 2.0 (KB929916) - Remote Code Execution - Important - None
* Windows Vista x64 Edition - Microsoft .NET Framework 2.0 (KB929916) - Remote Code Execution - Important - None
Immune Systems:
* Windows XP Service Pack 2 - Microsoft .NET Framework 3.0
* Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2 - Microsoft .NET Framework 3.0
* Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 - Microsoft .NET Framework 3.0
* Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2 - Microsoft .NET Framework 3.0
* Windows Vista - Microsoft .NET Framework 3.0
* Windows Vista x64 Edition - Microsoft .NET Framework 3.0
.NET PE Loader Vulnerability - CVE-2007-0041:
A remote code execution vulnerability exists in .NET Framework that could allow an attacker who successfully exploited this vulnerability to make changes to the system with the permissions of the logged-on user. If a user is logged in with administrative user rights, an attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
CVE Information:
CVE-2007-0041
ASP.NET Null Byte Termination Vulnerability - CVE-2007-0042:
An information disclosure vulnerability exists in .NET Framework that could allow an attacker who successfully exploited this vulnerability to bypass the security features of an ASP.NET Web site to download the contents of any Web page.
CVE Information:
CVE-2007-0042
.NET JIT Compiler Vulnerability - CVE-2007-0043:
A remote code execution vulnerability exists in .NET Framework Just In Time Compiler that could allow an attacker who successfully exploited this vulnerability to make changes to the system with the permissions of the logged-on user. If a user is logged on with administrative user rights, an attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
CVE Information:
CVE-2007-0043
|
|
|
|
|
