Summary
This host is missing an important security update according to Microsoft Bulletin MS13-052.
Impact
Successful exploitation could allow an attacker to execute arbitrary code, bypass security mechanism and take complete control of an affected system.
Solution
Run Windows Update and update the listed hotfixes or download and update mentioned hotfixes in the advisory from the below link, http://technet.microsoft.com/en-us/security/bulletin/ms13-052
Insight
Multiple flaws due to,
- Improper handling of TrueType font and multidimensional arrays of small structures
- Improper validation of permissions for certain objects performing reflection and delegate objects during serialization
Affected
Microsoft .NET Framework 1.0, 1.1, 2.0, 3.0, 3.5, 3.5.1, 4.0 and 4.5
Detection
Get the vulnerable file version and check appropriate patch is applied or not.
References
Severity
Classification
-
CVE CVE-2013-3129, CVE-2013-3131, CVE-2013-3132, CVE-2013-3133, CVE-2013-3134, CVE-2013-3171 -
CVSS Base Score: 9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C
Related Vulnerabilities
- Microsoft IIS FTP Server 'Malformed FTP List Request' DOS Vulnerability
- Certificate Validation Flaw Could Enable Identity Spoofing (Q328145)
- Microsoft Distributed File System Remote Code Execution Vulnerabilities (2535512)
- Microsoft Excel Remote Code Execution Vulnerabilities (968557)
- Microsoft Internet Explorer mshtml.dll Remote Memory Corruption Vulnerability (942615)