| Revision Date: | 2014-08-18 | Version: | 22 | | Title: | Chart Control Information Disclosure Vulnerability | | Description: | The ASP.NET Chart controls in Microsoft .NET Framework 4, and Chart Control for Microsoft .NET Framework 3.5 SP1, do not properly verify functions in URIs, which allows remote attackers to read arbitrary files via special characters in a URI in an HTTP request, aka "Chart Control Information Disclosure Vulnerability." | | Family: | windows | Class: | vulnerability | | Status: | ACCEPTED | Reference(s): | CVE-2011-1977
| | Platform(s): | Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Vista
Microsoft Windows XP
| Product(s): | Chart Control for Microsoft .NET Framework 3.5 Service Pack 1
Microsoft .NET Framework
| | Definition Synopsis | | .NET Framework 4.0 on Windows XP x86/x64, Server 2003 x86/x64/ia64, Vista x86/x64, Server 2008 x86/x64/ia64, Windows 7 x86/x64, Server 2008 r2 x64/ia64 (KB2539636) Windows XP x86/x64, Windows Server 2003 x86/x64/ia64, Vista x86/x64, Server 2008 x86/x64/ia64, Windows 7 x86/x64, Server 2008 r2 x64/ia64
Microsoft Windows XP (32-bit) is installed
OR Microsoft Windows XP x64 is installed
OR Microsoft Windows Server 2003 (32-bit) is installed
OR Microsoft Windows Server 2003 (x64) is installed
OR Microsoft Windows Server 2003 (ia64) Gold is installed
OR Microsoft Windows Vista (32-bit) is installed
OR Microsoft Windows Vista x64 Edition is installed
OR Microsoft Windows Server 2008 (32-bit) is installed
OR Microsoft Windows Server 2008 (64-bit) is installed
OR Microsoft Windows Server 2008 (ia-64) is installed
OR Microsoft Windows 7 (32-bit) is installed
OR Microsoft Windows 7 x64 Edition is installed
OR Microsoft Windows Server 2008 R2 x64 Edition is installed
OR Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed
AND Microsoft .NET Framework 4.0 is installed
AND GDR or LDR Service branch
the version of System.Web.DataVisualization.dll is less than 4.0.30319.236
OR LDR
the version of System.Web.DataVisualization.dll is less than 4.0.30319.461
AND the version of System.Web.DataVisualization.dll is greater than or equal to 4.0.30319.400
OR Microsoft Chart Controls for Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 SP1 is installed
AND Microsoft Chart Controls for Microsoft .NET Framework 3.5 is installed
AND the version of System.Web.DataVisualization.dll is less than 3.5.30729.5681
|
|