Executive Summary

Title Vulnerability in .NET Framework Could Allow Remote Code Execution (2671605)
Name MS12-025 First vendor Publication 2012-04-10
Vendor Microsoft Last vendor Modification 2012-06-12
Severity (Vendor) Critical Revision 2.0

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores


Revision Note: V2.0 (June 12, 2012): Bulletin rereleased to reoffer the update for all affected software. Customers who have already successfully installed the update originally offered on April 10, 2012 are encouraged to install the reoffered update. See the Update FAQ for details.

Summary: This security update resolves one privately reported vulnerability in Microsoft .NET Framework. The vulnerability could allow remote code execution on a client system if a user views a specially crafted webpage using a web browser that can run XAML Browser Applications (XBAPs). Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. The vulnerability could also allow remote code execution on a server system running IIS, if that server allows processing ASP.NET pages and an attacker succeeds in uploading a specially crafted ASP.NET page to that server and then executes the page, as could be the case in a web hosting scenario. This vulnerability could also be used by Windows .NET applications to bypass Code Access Security (CAS) restrictions. In a web browsing attack scenario, an attacker could host a website that contains a webpage that is used to exploit this vulnerability. In addition, compromised websites and websites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these websites. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes users to the attacker's website.

Original Source

Url : http://technet.microsoft.com/en-us/security/bulletin/ms12-025

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:15495
Oval ID: oval:org.mitre.oval:def:15495
Title: .NET Framework Parameter Validation Vulnerability
Description: Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate function parameters, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework Parameter Validation Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2012-0163
Version: 8
Platform(s): Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows 7
Product(s): Microsoft .NET Framework 1.0
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0
Microsoft .NET Framework 3.5.1
Microsoft .NET Framework 4
Definition Synopsis:

CPE : Common Platform Enumeration

Application 7

ExploitDB Exploits

id Description
2012-04-24 .NET Framework EncoderParameter Integer Overflow Vulnerability

OpenVAS Exploits

Date Description
2012-04-11 Name : Microsoft .NET Framework Remote Code Execution Vulnerability (2671605)
File : nvt/secpod_ms12-025.nasl

Snort® IPS/IDS

Date Description
2014-01-10 Microsoft Windows .NET invalid parsing of graphics data attempt
RuleID : 22042 - Revision : 10 - Type : FILE-EXECUTABLE
2014-01-10 Microsoft Windows .NET invalid parsing of graphics data attempt
RuleID : 21792 - Revision : 11 - Type : FILE-EXECUTABLE

Nessus® Vulnerability Scanner

Date Description
2012-04-11 Name : The .NET Framework install on the remote Windows host could allow arbitrary c...
File : smb_nt_ms12-025.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
Date Informations
2016-04-26 23:06:13
  • Multiple Updates
2014-02-17 11:47:18
  • Multiple Updates
2014-01-19 21:30:49
  • Multiple Updates
2013-03-07 13:21:01
  • Multiple Updates