Oval Definition:	oval:org.mitre.oval:def:26465
Revision Date: 2014-11-10 Version: 22 Title: .NET ASLR vulnerability - CVE-2014-4062 (MS14-046) Description: Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, and 3.5.1 does not properly implement the ASLR protection mechanism, which allows remote attackers to obtain sensitive address information via a crafted web site, aka ".NET ASLR Vulnerability." Family: windows Class: vulnerability Status: ACCEPTED Reference(s): CVE-2014-4062 Platform(s): Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 Microsoft Windows Vista Product(s): Microsoft .NET Framework 2.0 Microsoft .NET Framework 3.0 Microsoft .NET Framework 3.5 Microsoft .NET Framework 3.5.1 Definition Synopsis Vista / 2k8 + vulnerable file version Vista / 2K8 Microsoft Windows Vista (32-bit) is installed OR Microsoft Windows Vista x64 Edition is installed OR Microsoft Windows Server 2008 (32-bit) is installed OR Microsoft Windows Server 2008 (64-bit) is installed OR Microsoft Windows Server 2008 (ia-64) is installed AND Check for vulnerable version Check for LDR Check if the version of mscorlib.dll is less than 2.0.50727.7067 AND Check if the version of mscorlib.dll is greater than or equal to 2.0.50727.7000 OR Check if the version of mscorlib.dll is less than 2.0.50727.4252 AND Microsoft .NET Framework 2.0 Service Pack 2 is installed OR Vista / 2k8 + vulnerable file version Vista / 2K8 Microsoft Windows Vista (32-bit) is installed OR Microsoft Windows Vista x64 Edition is installed OR Microsoft Windows Server 2008 (32-bit) is installed OR Microsoft Windows Server 2008 (64-bit) is installed OR Microsoft Windows Server 2008 (ia-64) is installed AND Check for vulnerable version Check for LDR Check if the version of System.IdentityModel.dll is less than 3.0.4506.7097 AND Check if version of System.IdentityModel.dll is greater than or equal to 3.0.4506.7000 OR Check if the version of System.IdentityModel.dll is less than 3.0.4506.4223 AND Microsoft .NET Framework 3.0 SP2 is installed OR Win 7 / R2 + vulnerable file version Win 7 / R2 Microsoft Windows 7 (32-bit) is installed OR Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed OR Microsoft Windows Server 2008 R2 x64 Edition is installed OR Microsoft Windows 7 x64 Edition is installed AND Check for vulnerable version Check for LDR Check if the version of mscorlib.dll is less than 2.0.50727.8630 AND Check if the version of mscorlib.dll is greater than or equal to 2.0.50727.8600 OR LDR Check if the version of System.IdentityModel.dll is less than 3.0.4506.7082 AND Check if version of System.IdentityModel.dll is greater than or equal to 3.0.4506.7000 OR Check if the version of System.IdentityModel.dll is less than 3.0.4506.5461 OR Check if the version of mscorlib.dll is less than 2.0.50727.5483 AND Microsoft .NET Framework 3.5 SP1 is installed OR Win 8/2k12 and vulnerable file version Win 8 / 2k12 Microsoft Windows 8 (x86) is installed OR Microsoft Windows 8 (x64) is installed OR Microsoft Windows Server 2012 (64-bit) is installed AND Check for vulnerable version Check for LDR Check if the version of mscorlib.dll is less than 2.0.50727.7057 AND Check if the version of mscorlib.dll is greater than or equal to 2.0.50727.7000 OR LDR Check if the version of System.IdentityModel.dll is less than 3.0.4506.7082 AND Check if version of System.IdentityModel.dll is greater than or equal to 3.0.4506.7000 OR Check if the version of mscorlib.dll is less than 2.0.50727.6419 OR Check if the version of System.IdentityModel.dll is less than 3.0.4506.6416 AND Microsoft .NET Framework 3.5 SP1 is installed OR Win 8.1/2k12 R2 and vulnerable file version Win 8.1 / 2k12 R2 Microsoft Windows 8.1 (x86) is installed OR Microsoft Windows 8.1 (x64) is installed OR Microsoft Windows Server 2012 R2 is installed AND Check for vulnerable version Check for LDR Check if the version of mscorlib.dll is less than 2.0.50727.8612 AND Check if the version of mscorlib.dll is greater than or equal to 2.0.50727.8600 OR LDR Check if the version of System.IdentityModel.dll is less than 3.0.4506.8603 AND Check if the version of System.IdentityModel.dll is greater than or equal to 3.0.4506.8600 OR Check if the version of mscorlib.dll is less than 2.0.50727.8007 OR Check if the version of System.IdentityModel.dll is less than 3.0.4506.8003 AND Microsoft .NET Framework 3.5 SP1 is installed AND Check if KB2966828 and KB2966826 are installed NOT KB2966828 is installed OR NOT KB2966826 is installed
BACK