Summary
This host is missing an important security update according to Microsoft Bulletin MS13-052.
Impact
Successful exploitation could allow an attacker to execute arbitrary code, bypass security mechanism and take complete control of an affected system.
Solution
Run Windows Update and update the listed hotfixes or download and update mentioned hotfixes in the advisory from the below link, http://technet.microsoft.com/en-us/security/bulletin/ms13-052
Insight
Multiple flaws due to,
- Improper handling of TrueType font and multidimensional arrays of small structures
- Improper validation of permissions for certain objects performing reflection and delegate objects during serialization
Affected
Microsoft .NET Framework 1.0, 1.1, 2.0, 3.0, 3.5, 3.5.1, 4.0 and 4.5
Detection
Get the vulnerable file version and check appropriate patch is applied or not.
References
Severity
Classification
-
CVE CVE-2013-3129, CVE-2013-3131, CVE-2013-3132, CVE-2013-3133, CVE-2013-3134, CVE-2013-3171 -
CVSS Base Score: 9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C
Related Vulnerabilities
- Microsoft .NET Common Language Runtime Remote Code Execution Vulnerability (2265906)
- Microsoft Active Directory LDAP Remote Code Execution Vulnerability (969805)
- Cumulative Security Update for Internet Explorer (961260)
- Cumulative Security Update for Internet Explorer (928090)
- Microsoft Internet Explorer Memory Corruption Vulnerability (2755801)