CVE-2009-2497

14.10.2009, 10:30

The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0, 2.0 SP1, 2.0 SP2, 3.5, and 3.5 SP1, and Silverlight 2, does not properly handle interfaces, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP), (2) a crafted Silverlight application, (3) a crafted ASP.NET application, or (4) a crafted .NET Framework application, aka "Microsoft Silverlight and Microsoft .NET Framework CLR Vulnerability."

Code Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Vector
NIST	NIST	9.3 UNKNOWN	NETWORK	MEDIUM	AV:N/AC:M/Au:N/C:C/I:C/A:C
microsoft	CNA	---			---
CVE	ADP	---			---

Base Score

CVSS 3.x

EPSS Score

Percentile: 97%

Vendor	Product	Version
microsoft	windows_2000	*
microsoft	.net_framework	2.0:sp1
microsoft	.net_framework	2.0:sp2
microsoft	windows_server_2003	*
microsoft	windows_server_2008	*
microsoft	windows_server_2008	*
microsoft	windows_server_2008	*
microsoft	windows_server_2008	*
microsoft	windows_server_2008	*
microsoft	windows_server_2008	-
microsoft	windows_server_2008	-
microsoft	.net_framework	1.1:sp1
microsoft	.net_framework	2.0:sp1
microsoft	.net_framework	2.0:sp2
microsoft	.net_framework	3.5
microsoft	.net_framework	3.5:sp1
microsoft	windows_vista	*
microsoft	windows_vista	*
microsoft	windows_vista	*
microsoft	windows_vista	*
microsoft	.net_framework	1.1:sp1
microsoft	.net_framework	2.0
microsoft	.net_framework	2.0:sp1
microsoft	.net_framework	2.0:sp2
microsoft	.net_framework	3.5
microsoft	.net_framework	3.5:sp1
microsoft	.net_framework	1.1:sp1
microsoft	windows_7	-
microsoft	windows_server_2008	*
microsoft	windows_server_2008	*
microsoft	.net_framework	1.0:sp3
microsoft	.net_framework	1.1:sp1
microsoft	.net_framework	2.0:sp1
microsoft	.net_framework	2.0:sp2
microsoft	.net_framework	3.5
microsoft	.net_framework	3.5:sp1
microsoft	windows_xp	*
microsoft	windows_xp	*
microsoft	windows_xp	-

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-94 - Improper Control of Generation of Code ('Code Injection')
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References

http://www.us-cert.gov/cas/techalerts/TA09-286A.html

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-061

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6510

http://www.us-cert.gov/cas/techalerts/TA09-286A.html

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-061

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6510