Vulnerability-Lookup

CNVD-2015-05953

Vulnerability from cnvd - Published: 2015-09-14

Title

Microsoft .NET Framework权限提升漏洞（CNVD-2015-05953）

Description

Microsoft .NET Framework是美国微软（Microsoft）公司开发的一种全面且一致的编程模型，也是一个用于构建Windows、Windows Store、Windows Phone、Windows Server和Microsoft Azure的应用程序的开发平台。 Microsoft .NET Framework中存在权限提升漏洞。攻击者可利用该漏洞控制受影响系统。

Severity

高

Patch Name

Microsoft .NET Framework权限提升漏洞（CNVD-2015-05953）的补丁

Patch Description

Formal description

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：https://technet.microsoft.com/library/security/ms15-101

Reference

http://technet.microsoft.com/security/bulletin/MS15-101

Impacted products

Name
['Microsoft .NET Framework 4.5', 'Microsoft .NET Framework 2.0 SP2', 'Microsoft .NET Framework 3.5', 'Microsoft .NET Framework 4.0', 'Microsoft .NET Framework 3.5.1', 'Microsoft .NET Framework 4.5.1', 'Microsoft .Net Framework 4.5.2', 'Microsoft .NET Framework 4.6']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-2504"
    }
  },
  "description": "Microsoft .NET Framework\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u5f00\u53d1\u7684\u4e00\u79cd\u5168\u9762\u4e14\u4e00\u81f4\u7684\u7f16\u7a0b\u6a21\u578b\uff0c\u4e5f\u662f\u4e00\u4e2a\u7528\u4e8e\u6784\u5efaWindows\u3001Windows Store\u3001Windows Phone\u3001Windows Server\u548cMicrosoft Azure\u7684\u5e94\u7528\u7a0b\u5e8f\u7684\u5f00\u53d1\u5e73\u53f0\u3002\r\n\r\nMicrosoft .NET Framework\u4e2d\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u63a7\u5236\u53d7\u5f71\u54cd\u7cfb\u7edf\u3002",
  "discovererName": "Microsoft",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1ahttps://technet.microsoft.com/library/security/ms15-101",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-05953",
  "openTime": "2015-09-14",
  "patchDescription": "Microsoft .NET Framework\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u5f00\u53d1\u7684\u4e00\u79cd\u5168\u9762\u4e14\u4e00\u81f4\u7684\u7f16\u7a0b\u6a21\u578b\uff0c\u4e5f\u662f\u4e00\u4e2a\u7528\u4e8e\u6784\u5efaWindows\u3001Windows Store\u3001Windows Phone\u3001Windows Server\u548cMicrosoft Azure\u7684\u5e94\u7528\u7a0b\u5e8f\u7684\u5f00\u53d1\u5e73\u53f0\u3002 \r\n\r\nMicrosoft .NET Framework\u4e2d\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u63a7\u5236\u53d7\u5f71\u54cd\u7cfb\u7edf\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft .NET Framework\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2015-05953\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Microsoft .NET Framework 4.5",
      "Microsoft .NET Framework 2.0 SP2",
      "Microsoft .NET Framework 3.5",
      "Microsoft .NET Framework 4.0",
      "Microsoft .NET Framework 3.5.1",
      "Microsoft .NET Framework 4.5.1",
      "Microsoft .Net Framework 4.5.2",
      "Microsoft .NET Framework 4.6"
    ]
  },
  "referenceLink": "http://technet.microsoft.com/security/bulletin/MS15-101",
  "serverity": "\u9ad8",
  "submitTime": "2015-09-10",
  "title": "Microsoft .NET Framework\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2015-05953\uff09"
}

CVE-2015-2504 (GCVE-0-2015-2504)

Vulnerability from cvelistv5 – Published: 2015-09-09 00:00 – Updated: 2024-08-06 05:17

Summary

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 improperly counts objects before performing an array copy, which allows remote attackers to (1) execute arbitrary code via a crafted XAML browser application (XBAP) or (2) bypass Code Access Security restrictions via a crafted .NET Framework application, aka ".NET Elevation of Privilege Vulnerability."

Severity ?

No CVSS data available.

CWE

Assigner

microsoft

References

URL

Tags

	http://www.securitytracker.com/id/1033493	vdb-entryx_refsource_SECTRACK
	http://www.securityfocus.com/bid/76560	vdb-entryx_refsource_BID
	https://docs.microsoft.com/en-us/security-updates…	vendor-advisoryx_refsource_MS

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T05:17:27.250Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1033493",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1033493"
          },
          {
            "name": "76560",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/76560"
          },
          {
            "name": "MS15-101",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-101"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-09-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 improperly counts objects before performing an array copy, which allows remote attackers to (1) execute arbitrary code via a crafted XAML browser application (XBAP) or (2) bypass Code Access Security restrictions via a crafted .NET Framework application, aka \".NET Elevation of Privilege Vulnerability.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-12T19:57:01",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "1033493",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1033493"
        },
        {
          "name": "76560",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/76560"
        },
        {
          "name": "MS15-101",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-101"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2015-2504",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 improperly counts objects before performing an array copy, which allows remote attackers to (1) execute arbitrary code via a crafted XAML browser application (XBAP) or (2) bypass Code Access Security restrictions via a crafted .NET Framework application, aka \".NET Elevation of Privilege Vulnerability.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1033493",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1033493"
            },
            {
              "name": "76560",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/76560"
            },
            {
              "name": "MS15-101",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-101"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2015-2504",
    "datePublished": "2015-09-09T00:00:00",
    "dateReserved": "2015-03-19T00:00:00",
    "dateUpdated": "2024-08-06T05:17:27.250Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2015-05953

CVE-2015-2504 (GCVE-0-2015-2504)

Tags

Sightings

Nomenclature