---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: Microsoft .NET Framework Multiple Vulnerabilities SECUNIA ADVISORY ID: SA37006 VERIFY ADVISORY: http://secunia.com/advisories/37006/ DESCRIPTION: Some vulnerabilities have been reported in Microsoft .NET Framework, which can be exploited by malicious people to compromise a vulnerable system. 1) An unspecified error can be exploited to obtain a managed pointer to stack memory, which can be exploited to execute arbitrary code e.g. via a specially crafted ASP .NET application, or XBAP (XAML browser application). 2) An error in the verification of Microsoft .NET verifiable code can be exploited to bypass a type equality check and execute arbitrary code e.g. via a specially crafted ASP .NET application or XBAP. 3) An error exists in the Microsoft .NET Common Language Runtime (CLR) in the handling of interfaces. This can be exploited to corrupt memory and execute arbitrary code e.g. via a specially crafted ASP .NET application or XBAP. SOLUTION: Apply patches. -- Microsoft Windows 2000 SP4 -- Microsoft .NET Framework 1.1 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=78ac8b97-8327-4ae1-8bb0-6cf227f3968f Microsoft .NET Framework 2.0 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=d4a328b5-5470-46b0-86c7-cfe0e6a3ea01 Microsoft .NET Framework 2.0 Service Pack 2: http://www.microsoft.com/downloads/details.aspx?familyid=491874d4-5eea-4545-9b7d-3861857c862e -- Windows XP SP2 / SP3 -- Microsoft .NET Framework 1.0 Service Pack 3 (Media Center Edition 2005 and Tablet PC Edition 2005 only): http://www.microsoft.com/downloads/details.aspx?familyid=1bc56c26-1c7c-47e3-94f4-37af7e00392c Microsoft .NET Framework 1.1 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=78ac8b97-8327-4ae1-8bb0-6cf227f3968f Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5: http://www.microsoft.com/downloads/details.aspx?familyid=d4a328b5-5470-46b0-86c7-cfe0e6a3ea01 Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=491874d4-5eea-4545-9b7d-3861857c862e -- Windows XP Professional x64 Edition SP2 -- Microsoft .NET Framework 1.1 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=78ac8b97-8327-4ae1-8bb0-6cf227f3968f Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5: http://www.microsoft.com/downloads/details.aspx?familyid=d4a328b5-5470-46b0-86c7-cfe0e6a3ea01 Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=491874d4-5eea-4545-9b7d-3861857c862e -- Windows Server 2003 SP2 -- Microsoft .NET Framework 1.1 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=d1b4a58b-f0b1-4400-a6e6-0255b0513bd1 Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5: http://www.microsoft.com/downloads/details.aspx?familyid=d4a328b5-5470-46b0-86c7-cfe0e6a3ea01 Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=491874d4-5eea-4545-9b7d-3861857c862e -- Windows Server 2003 x64 Edition SP2 -- Microsoft .NET Framework 1.1 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=78ac8b97-8327-4ae1-8bb0-6cf227f3968f Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5: http://www.microsoft.com/downloads/details.aspx?familyid=d4a328b5-5470-46b0-86c7-cfe0e6a3ea01 Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=491874d4-5eea-4545-9b7d-3861857c862e -- Windows Server 2003 with SP2 for Itanium-based Systems -- Microsoft .NET Framework 1.1 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=78ac8b97-8327-4ae1-8bb0-6cf227f3968f Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5: http://www.microsoft.com/downloads/details.aspx?familyid=d4a328b5-5470-46b0-86c7-cfe0e6a3ea01 Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=491874d4-5eea-4545-9b7d-3861857c862e -- Windows Vista (optionally with SP1 and SP2) -- Microsoft .NET Framework 1.1 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=78ac8b97-8327-4ae1-8bb0-6cf227f3968f -- Windows Vista -- Microsoft .NET Framework 2.0: http://www.microsoft.com/downloads/details.aspx?familyid=6f99521e-86b3-4083-9132-e5ac06d40b63 Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5: http://www.microsoft.com/downloads/details.aspx?familyid=3cf329c6-6d3d-41eb-bb72-8ba241df0882 Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=7438eb1e-6e86-4aa1-b1f4-f71a7699d233 -- Windows Vista SP1 -- Microsoft .NET Framework 2.0 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=30e5410d-0942-4964-9037-52330488efda Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=72fe9066-2397-439d-82fb-2b7f9d2bcce8 -- Windows Vista Service Pack 2 -- Microsoft .NET Framework 2.0 Service Pack 2: http://www.microsoft.com/downloads/details.aspx?familyid=614a92ee-0512-4ccc-b6b8-32ebcec8e6a4 -- Windows Vista x64 Edition (optionally with SP1 and SP2) -- Microsoft .NET Framework 1.1 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=78ac8b97-8327-4ae1-8bb0-6cf227f3968f -- Windows Vista x64 Edition -- Microsoft .NET Framework 2.0: http://www.microsoft.com/downloads/details.aspx?familyid=6f99521e-86b3-4083-9132-e5ac06d40b63 Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5: http://www.microsoft.com/downloads/details.aspx?familyid=3cf329c6-6d3d-41eb-bb72-8ba241df0882 Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=7438eb1e-6e86-4aa1-b1f4-f71a7699d233 -- Windows Vista x64 Edition SP1 -- Microsoft .NET Framework 2.0 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=30e5410d-0942-4964-9037-52330488efda Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=72fe9066-2397-439d-82fb-2b7f9d2bcce8 -- Windows Vista x64 Edition Service Pack 2 -- Microsoft .NET Framework 2.0 Service Pack 2: http://www.microsoft.com/downloads/details.aspx?familyid=614a92ee-0512-4ccc-b6b8-32ebcec8e6a4 -- Windows Server 2008 for 32-bit Systems (optionally with SP2) -- Microsoft .NET Framework 1.1 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=78ac8b97-8327-4ae1-8bb0-6cf227f3968f -- Windows Server 2008 for 32-bit Systems -- Microsoft .NET Framework 2.0 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=30e5410d-0942-4964-9037-52330488efda Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=72fe9066-2397-439d-82fb-2b7f9d2bcce8 -- Windows Server 2008 for 32-bit Systems Service Pack 2 -- Microsoft .NET Framework 2.0 Service Pack 2: http://www.microsoft.com/downloads/details.aspx?familyid=614a92ee-0512-4ccc-b6b8-32ebcec8e6a4 -- Windows Server 2008 for x64-based Systems (optionally with SP2) -- Microsoft .NET Framework 1.1 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=78ac8b97-8327-4ae1-8bb0-6cf227f3968f -- Windows Server 2008 for x64-based Systems -- Microsoft .NET Framework 2.0 Service Pack 1 http://www.microsoft.com/downloads/details.aspx?familyid=30e5410d-0942-4964-9037-52330488efda Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1 http://www.microsoft.com/downloads/details.aspx?familyid=72fe9066-2397-439d-82fb-2b7f9d2bcce8 -- Windows Server 2008 for x64-based Systems SP2 -- Microsoft .NET Framework 2.0 Service Pack 2: http://www.microsoft.com/downloads/details.aspx?familyid=614a92ee-0512-4ccc-b6b8-32ebcec8e6a4 -- Windows Server 2008 for Itanium-based Systems (optionally with SP2) -- Microsoft .NET Framework 1.1 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=78ac8b97-8327-4ae1-8bb0-6cf227f3968f -- Windows Server 2008 for Itanium-based Systems -- Microsoft .NET Framework 2.0 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=30e5410d-0942-4964-9037-52330488efda Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=72fe9066-2397-439d-82fb-2b7f9d2bcce8 -- Windows Server 2008 for Itanium-based Systems SP2 -- Microsoft .NET Framework 2.0 Service Pack 2: http://www.microsoft.com/downloads/details.aspx?familyid=614a92ee-0512-4ccc-b6b8-32ebcec8e6a4 -- Windows 7 for 32-bit Systems -- Microsoft .NET Framework 1.1 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=78ac8b97-8327-4ae1-8bb0-6cf227f3968f -- Windows 7 for x64-based Systems -- Microsoft .NET Framework 1.1 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=78ac8b97-8327-4ae1-8bb0-6cf227f3968f -- Windows Server 2008 R2 for x64-based Systems -- Microsoft .NET Framework 1.1 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=78ac8b97-8327-4ae1-8bb0-6cf227f3968f -- Windows Server 2008 R2 for Itanium-based Systems -- Microsoft .NET Framework 1.1 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?familyid=78ac8b97-8327-4ae1-8bb0-6cf227f3968f PROVIDED AND/OR DISCOVERED BY: 1) The vendor credits Pavel Minaev. 2) The vendor credits Jeroen Frijters of Sumatra. ORIGINAL ADVISORY: MS09-061 (KB974378, KB953297, KB953300, KB974417, KB953295, KB953298, KB974468, KB974292, KB974467, KB974291, KB974469, KB974470): http://www.microsoft.com/technet/security/bulletin/MS09-061.mspx ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------