ZeroBox Vulnerability Database

漏洞起因
设计错误
危险等级
中

影响系统
Microsoft .NET Framework 4.0
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 2.0 SP2
Microsoft .NET Framework 2.0 SP1
Microsoft .NET Framework 2.0
Microsoft .NET Framework 1.1 SP3
Microsoft .NET Framework 1.1 SP2
Microsoft .NET Framework 1.1 SP1
Microsoft .NET Framework 1.1

不受影响系统

危害
远程攻击者可以利用漏洞以目标用户上下文执行任意命令。

攻击所需条件
攻击者必须构建特制链接，诱使用户解析。

漏洞信息
Microsoft .NET Framework是一个流行的软件开发工具包。
当表单验证使用滑动期限(sliding expiry)时ASP.NET Framework处理缓存内存存在特权提升漏洞。攻击者成功利用漏洞诱使目标用户解析特制链接，以目标用户上下文执行任意命令。
要成功利用此漏洞需要使用了”OutputCache”选项对ASP.NET应答进行缓存。

测试方法

厂商解决方案
用户可参考如下供应商提供的安全补丁：
Microsoft .NET Framework 3.5 SP1
Microsoft Security Update for Microsoft .NET Framework 3.5 Service Pack 1 on Windows XP, Windows Server 2003,
http://www.microsoft.com/downloads/details.aspx?familyid=306acd0a-bea2 -40dd-a639-f381587c9eb7
Microsoft Security Update for Microsoft .NET Framework 3.5.1 on Windows 7 and Windows Server 2008 R2
http://www.microsoft.com/downloads/details.aspx?familyid=2de28d32-1efd -4177-82e6-19a08266096c
Microsoft Security Update for Microsoft .NET Framework 3.5.1 on Windows 7 Service Pack 1 and Windows Server 20
http://www.microsoft.com/downloads/details.aspx?familyid=26e0b56d-9228 -49cf-9276-0741257567a9
Microsoft .NET Framework 2.0 SP2
Microsoft Security Update for Microsoft .NET Framework 2.0 Service Pack 2 on Windows Server 2003 and Windows X
http://www.microsoft.com/downloads/details.aspx?familyid=eff633f7-abd9 -45cc-acbd-4885123dbed2
Microsoft Security Update for Microsoft .NET Framework 2.0 Service Pack 2 on Windows Vista Service Pack 2 and
http://www.microsoft.com/downloads/details.aspx?familyid=49050cf2-949a -40e5-b2ee-6257a3837294
Microsoft .NET Framework 4.0
Microsoft Security Update for Microsoft .NET Framework 4
http://www.microsoft.com/downloads/details.aspx?familyid=37a8fb34-e3ad -4605-980b-28361889ce72
Microsoft .NET Framework 1.1 SP1
Microsoft Security Update for Microsoft .NET Framework 1.1 Service Pack 1 on Windows Server 2003 Service Pack
http://www.microsoft.com/downloads/details.aspx?familyid=7538762a-50e9 -4f13-a60e-ff99aa8fbbf8
Microsoft Security Update for Microsoft .NET Framework 1.1 Service Pack 1 on Windows XP, Windows Server 2003 (
http://www.microsoft.com/downloads/details.aspx?familyid=471e1f51-c79c -4285-9f1e-aee1e4c4f189

漏洞提供者
Microsoft