Summary
This host is missing an important security update according to Microsoft Bulletin MS13-052.
Impact
Successful exploitation could allow an attacker to execute arbitrary code, bypass security mechanism and take complete control of an affected system.
Solution
Run Windows Update and update the listed hotfixes or download and update mentioned hotfixes in the advisory from the below link, http://technet.microsoft.com/en-us/security/bulletin/ms13-052
Insight
Multiple flaws due to,
- Improper handling of TrueType font and multidimensional arrays of small structures
- Improper validation of permissions for certain objects performing reflection and delegate objects during serialization
Affected
Microsoft .NET Framework 1.0, 1.1, 2.0, 3.0, 3.5, 3.5.1, 4.0 and 4.5
Detection
Get the vulnerable file version and check appropriate patch is applied or not.
References
Severity
Classification
-
CVE CVE-2013-3129, CVE-2013-3131, CVE-2013-3132, CVE-2013-3133, CVE-2013-3134, CVE-2013-3171 -
CVSS Base Score: 9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C
Related Vulnerabilities
- Host Integration Server RPC Service Remote Code Execution Vulnerability (956695)
- Microsoft .NET Common Language Runtime Remote Code Execution Vulnerability (2265906)
- Internet Explorer Vector Markup Language Remote Code Execution Vulnerability (2544521)
- Microsoft IIS FTP Server 'Malformed FTP List Request' DOS Vulnerability
- Microsoft DirectShow Remote Code Execution Vulnerability (977935)