Oval Definition:	oval:org.mitre.oval:def:26601
Revision Date: 2015-12-22 Version: 22 Title: .NET framework denial of service vulnerability - CVE-2014-4072 (MS14-053) Description: Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly use a hash table for request data, which allows remote attackers to cause a denial of service (resource consumption and ASP.NET performance degradation) via crafted requests, aka ".NET Framework Denial of Service Vulnerability." Family: windows Class: vulnerability Status: ACCEPTED Reference(s): CVE-2014-4072 Platform(s): Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 Microsoft Windows Vista Product(s): Microsoft .NET Framework 1.1 Microsoft .NET Framework 2.0 Microsoft .NET Framework 3.0 Microsoft .NET Framework 3.5.1 Microsoft .NET Framework 4.0 Microsoft .NET Framework 4.5 Microsoft .NET Framework 4.5.1 Microsoft .NET Framework 4.5.2 Definition Synopsis .net 1.1 sp1/versions Check if the version of mscorlib.dll is less than 1.1.4322.2510 AND Microsoft .NET Framework 1.1 Service Pack 1 is Installed AND Microsoft Windows Server 2003 (32-bit) is installed OR .net 2.0 sp2/server 2003/versions either os Microsoft Windows Server 2003 for Itanium is installed OR Microsoft Windows Server 2003 (32-bit) is installed OR Microsoft Windows Server 2003 (x64) is installed AND Microsoft .NET Framework 2.0 Service Pack 2 is installed AND either file versions GDR/LDR Check if the version of mscorlib.dll is less than 2.0.50727.3662 OR ldr range Check if the version of mscorlib.dll is less than 2.0.50727.8637 AND Check if the version of mscorlib.dll is greater than or equal to 2.0.50727.8600 OR Vista / 2k8 + vulnerable file version Vista / 2K8 Microsoft Windows Vista (32-bit) is installed OR Microsoft Windows Vista x64 Edition is installed OR Microsoft Windows Server 2008 (32-bit) is installed OR Microsoft Windows Server 2008 (64-bit) is installed OR Microsoft Windows Server 2008 (ia-64) is installed AND either file versions Check if the version of mscorlib.dll is less than 2.0.50727.4253 OR ldr range Check if the version of mscorlib.dll is less than 2.0.50727.7071 AND Check if the version of mscorlib.dll is greater than or equal to 2.0.50727.7000 AND Microsoft .NET Framework 2.0 Service Pack 2 is installed OR .net 3.0 sp2/server 2003/versions either os Microsoft Windows Server 2003 (32-bit) is installed OR Microsoft Windows Server 2003 (x64) is installed AND Microsoft .NET Framework 3.0 SP2 is installed AND Check if the version of System.IdentityModel.dll is less than 3.0.4506.4068 OR Vista / 2k8 + vulnerable file version Vista / 2K8 Microsoft Windows Vista (32-bit) is installed OR Microsoft Windows Vista x64 Edition is installed OR Microsoft Windows Server 2008 (32-bit) is installed OR Microsoft Windows Server 2008 (64-bit) is installed OR Microsoft Windows Server 2008 (ia-64) is installed AND GDR/LDR Check if the version of system.identitymodel.dll is less than 3.0.4506.4222 OR ldr range Check if the version of System.IdentityModel.dll is less than 3.0.4506.8635 AND Check if the version of System.IdentityModel.dll is greater than or equal to 3.0.4506.8600 AND Microsoft .NET Framework 3.0 SP2 is installed OR Win 7 / R2 + vulnerable file version Win 7 / R2 Microsoft Windows 7 (32-bit) is installed OR Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed OR Microsoft Windows Server 2008 R2 x64 Edition is installed OR Microsoft Windows 7 x64 Edition is installed AND either file versions Check if the version of mscorlib.dll is less than 2.0.50727.5485 OR Check if the version of System.IdentityModel.dll is less than 3.0.4506.5463 OR ldr range Check if the version of System.IdentityModel.dll is less than 3.0.4506.8635 AND Check if the version of System.IdentityModel.dll is greater than or equal to 3.0.4506.8600 OR ldr range Check if the version of mscorlib.dll is less than 2.0.50727.7071 AND Check if the version of mscorlib.dll is greater than or equal to 2.0.50727.7000 AND Microsoft .NET Framework 3.5 SP1 is installed OR Win 8/2k12 and vulnerable file version Win 8 / 2k12 Microsoft Windows 8 (x86) is installed OR Microsoft Windows 8 (x64) is installed OR Microsoft Windows Server 2012 (64-bit) is installed AND either file versions Check if the version of mscorlib.dll is less than 2.0.50727.6421 OR Check if the version of System.IdentityModel.dll is less than 3.0.4506.6415 OR ldr range Check if the version of mscorlib.dll is less than 2.0.50727.7071 AND Check if the version of mscorlib.dll is greater than or equal to 2.0.50727.7000 OR ldr range Check if the version of System.IdentityModel.dll is less than 3.0.4506.8635 AND Check if the version of System.IdentityModel.dll is greater than or equal to 3.0.4506.8600 AND Microsoft .NET Framework 3.5 SP1 is installed OR .net 4.0/win server 2003/vista/server 2008/versions either os Microsoft Windows Server 2003 for Itanium is installed OR Microsoft Windows Server 2003 (32-bit) is installed OR Microsoft Windows Server 2003 (x64) is installed OR Microsoft Windows Vista (32-bit) is installed OR Microsoft Windows Vista x64 Edition is installed OR Microsoft Windows Server 2008 (32-bit) is installed OR Microsoft Windows Server 2008 (64-bit) is installed OR Microsoft Windows Server 2008 (ia-64) is installed OR Microsoft Windows 7 (32-bit) is installed OR Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed OR Microsoft Windows Server 2008 R2 x64 Edition is installed OR Microsoft Windows 7 x64 Edition is installed AND Microsoft .NET Framework 4.0 is installed AND GDR/LDR Check if the version of mscorlib.dll is less than 4.0.30319.1026 OR ldr range Check if the version of mscorlib.dll is less than 4.0.30319.2045 AND Check if the version of mscorlib.dll is greater than or equal to 4.0.30319.2000 OR .net 4.5/4.5.1/4.5.2/vista/server 2008/win 7/server 2008 R2/versions either os Microsoft Windows Vista (32-bit) is installed OR Microsoft Windows Vista x64 Edition is installed OR Microsoft Windows Server 2008 (32-bit) is installed OR Microsoft Windows Server 2008 (64-bit) is installed OR Microsoft Windows 7 (32-bit) is installed OR Microsoft Windows 7 x64 Edition is installed OR Microsoft Windows Server 2008 R2 x64 Edition is installed AND 4.5/4.5.1/4.5.2 Microsoft .NET Framework 4.5 is installed OR Microsoft .NET Framework 4.5.1 is installed OR Microsoft .NET Framework 4.5.2 is installed AND Check if the version of system.identitymodel.dll is less than 4.0.30319.34234 OR Win 8.1/2k12 R2 and vulnerable file version Win 8.1 / 2k12 R2 Microsoft Windows 8.1 (x86) is installed OR Microsoft Windows 8.1 (x64) is installed OR Microsoft Windows Server 2012 R2 is installed AND 4.5.1/4.5.2 Microsoft .NET Framework 4.5.1 is installed OR Microsoft .NET Framework 4.5.2 is installed AND either file versions Check if the version of system.identitymodel.dll is less than 4.0.30319.34230 OR ldr range Check if the version of system.identitymodel.dll is less than 4.0.30319.36241 AND Check if the version of System.IdentityModel.dll is greater than or equal to 4.0.30319.36000 OR .net 4.5/4.5.1/4.5.2/win 8/server 2012/versions either os Microsoft Windows 8 (x86) is installed OR Microsoft Windows 8 (x64) is installed OR Microsoft Windows Server 2012 (64-bit) is installed AND 4.5/4.5.1/4.5.2 Microsoft .NET Framework 4.5 is installed OR Microsoft .NET Framework 4.5.1 is installed OR Microsoft .NET Framework 4.5.2 is installed AND either file versions Check if the version of system.identitymodel.dll is less than 4.0.30319.34230 OR ldr range Check if the version of system.identitymodel.dll is less than 4.0.30319.36241 AND Check if the version of System.IdentityModel.dll is greater than or equal to 4.0.30319.36000 OR .net 3.5.1/win 8.1/server 2012 r2/versions either os Microsoft Windows 8.1 (x86) is installed OR Microsoft Windows 8.1 (x64) is installed OR Microsoft Windows Server 2012 R2 is installed AND Microsoft .NET Framework 3.5 SP1 is installed AND either file versions Check if the version of System.IdentityModel.dll is less than 3.0.4506.8002 OR ldr range Check if the version of System.IdentityModel.dll is less than 3.0.4506.8635 AND Check if the version of System.IdentityModel.dll is greater than or equal to 3.0.4506.8600 OR Check if the version of mscorlib.dll is less than 2.0.50727.8009 OR ldr Check if the version of mscorlib.dll is less than 2.0.50727.8615 AND Check if the version of mscorlib.dll is greater than or equal to 2.0.50727.8600
BACK