Vulnerability CVE-2009-0090 - CERT Civis.Net

Vulnerability Name:

CVE-2009-0090 (CCN-48293)

Assigned:

2009-10-13

Published:

2009-10-13

Updated:

2019-02-26

Summary:

Microsoft .NET Framework 1.0 SP3, 1.1 SP1, and 2.0 SP1 does not properly validate .NET verifiable code, which allows remote attackers to obtain unintended access to stack memory, and execute arbitrary code, via (1) a crafted XAML browser application (XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka "Microsoft .NET Framework Pointer Verification Vulnerability."

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2009-0090

Source: CCN
Type: SA37006
Microsoft .NET Framework Multiple Vulnerabilities

Source: CCN
Type: Microsoft Security Bulletin MS12-035
Vulnerabilities in .NET Framework Could Allow Remote Code Execution (2693777)

Source: CCN
Type: Microsoft Security Bulletin MS13-040
Vulnerabilities in .NET Framework Could Allow Spoofing (2836440)

Source: CCN
Type: Microsoft Security Bulletin MS13-082
Vulnerabilities in .NET Framework Could Allow Remote Code Execution (2878890)

Source: CCN
Type: Microsoft Security Bulletin MS15-080
Vulnerabilities in Microsoft Graphics Component Could Allow Remote Code Execution (3078662)

Source: CCN
Type: Microsoft Security Bulletin MS15-097
Vulnerabilities in Microsoft Graphics Component Could Allow Remote Code Execution (3089656)

Source: CCN
Type: Microsoft Security Bulletin MS15-115
Security Update for Microsoft Windows to Address Remote Code Execution (3105864)

Source: CCN
Type: Microsoft Security Bulletin MS15-116
Security Updates for Microsoft Office to Address Remote Code Execution (3104540)

Source: CCN
Type: Microsoft Security Bulletin MS15-123
Security Update for Skype for Business and Lync to Address Information Disclosure (3105872)

Source: CCN
Type: Microsoft Security Bulletin MS15-128
Security Update for Microsoft Graphics Component to Address Remote Code Execution (3104503)

Source: CCN
Type: Microsoft Security Bulletin MS15-129
Security Update for Silverlight to Address Remote Code Execution (3106614)

Source: CCN
Type: Microsoft Security Bulletin MS15-131
Security Update for Microsoft Office to Address Remote Code Execution (3116111)

Source: CCN
Type: Microsoft Security Bulletin MS15-132
Security Update for Microsoft Windows to Address Remote Code Execution (3116162)

Source: CCN
Type: Microsoft Security Bulletin MS15-135
Security Update for Windows Kernel Mode Drivers to Address Elevation of Privilege (3119075)

Source: CCN
Type: Microsoft Security Bulletin MS16-004
Security Update for Microsoft Office to Address Remote Code Execution - Critical (3124585)

Source: CCN
Type: Microsoft Security Bulletin MS16-006
Security Update for Silverlight to Address Remote Code Execution (3126036)

Source: CCN
Type: Microsoft Security Bulletin MS16-008
Security Update for Kernel to Address Elevation of Privilege (3124605)

Source: CCN
Type: Microsoft Security Bulletin MS16-014
Security update for Microsoft Windows to Address Remote Code Execution (3134228)

Source: CCN
Type: Microsoft Security Bulletin MS16-015
Security Update for Microsoft Office to Address Remote Code Execution (3134226)

Source: CCN
Type: Microsoft Security Bulletin MS16-029
Security Update for Microsoft Office to Address Remote Code Execution (3141806)

Source: CCN
Type: Microsoft Security Bulletin MS16-031
Security Update for Microsoft Windows to Address Elevation of Privilege (3140410)

Source: CCN
Type: Microsoft Security Bulletin MS16-035
Security Update for .NET Framework to Address Security Feature Bypass (3141780)

Source: CCN
Type: Microsoft Security Bulletin MS16-042
Security Update for Microsoft Office (3148775)

Source: CCN
Type: Microsoft Security Bulletin MS16-044
Security Update for Windows OLE (3146706)

Source: CCN
Type: Microsoft Security Bulletin MS16-048
Security Update for CSRSS (3148528)

Source: CCN
Type: Microsoft Security Bulletin MS16-054
Security Update for Microsoft Office (3155544)

Source: CCN
Type: Microsoft Security Bulletin MS16-060
Security Update for Windows Kernel (3154846)

Source: CCN
Type: Microsoft Security Bulletin MS16-061
Security Update for Microsoft RPC (3155520)

Source: CCN
Type: Microsoft Security Bulletin MS16-070
Security Update for Office (3163610)

Source: CCN
Type: Microsoft Security Bulletin MS16-088
Security Updates for Office (3170008)

Source: CCN
Type: Microsoft Security Bulletin MS16-092
Security Update for Windows Kernel (3171910)

Source: CCN
Type: Microsoft Security Bulletin MS16-097
Security Update for Microsoft Graphics Component (3177393)

Source: CCN
Type: Microsoft Security Bulletin MS16-099
Security Update for Office (3177451)

Source: CCN
Type: Microsoft Security Bulletin MS16-106
Security Update for Microsoft Graphics Component (3185848)

Source: CCN
Type: Microsoft Security Bulletin MS16-107
Security Update for Microsoft Office (3185852)

Source: CCN
Type: Microsoft Security Bulletin MS16-109
Security Update for Silverlight (3182373)

Source: CCN
Type: Microsoft Security Bulletin MS16-111
Security Update for Windows Kernel (3186973)

Source: CCN
Type: Microsoft Security Bulletin MS16-120
Security Update for Microsoft Graphics Component (3192884)

Source: CCN
Type: Microsoft Security Bulletin MS16-121
Security Update for Microsoft Office (3194063)

Source: CCN
Type: Microsoft Security Bulletin MS16-122
Security Update for Microsoft Video Control (3195360)

Source: CCN
Type: Microsoft Security Bulletin MS16-123
Security Update for Kernel-Mode Drivers (3192892)

Source: CCN
Type: Microsoft Security Bulletin MS16-124
Security Update for Windows Registry (3193227)

Source: CCN
Type: Microsoft Security Bulletin MS16-126
Security Update for Microsoft Internet Messaging API (3196067)

Source: CCN
Type: Microsoft Security Bulletin MS16-131
Security Update for Microsoft Video Control (3199151)

Source: CCN
Type: Microsoft Security Bulletin MS16-133
Security Update for Microsoft Office (3199168)

Source: CCN
Type: Microsoft Security Bulletin MS16-139
Security Update for Windows Kernel (3199720)

Source: CCN
Type: Microsoft Security Bulletin MS16-148
Security Update for Microsoft Office (3204068)

Source: CCN
Type: Microsoft Security Bulletin MS16-155
Security Update for .NET Framework (3205640)

Source: CCN
Type: Microsoft Security Bulletin MS17-002
Security Update for Microsoft Office (3214291)

Source: CCN
Type: Microsoft Security Bulletin MS17-006
Cumulative Security Update for Internet Explorer (4013073)

Source: CCN
Type: Microsoft Security Bulletin MS17-013
Security Update for Microsoft Graphics Component (4013075)

Source: CCN
Type: Microsoft Security Bulletin MS17-014
Security Update for Microsoft Office (4013241)

Source: CCN
Type: Microsoft Security Bulletin MS09-061
Vulnerabilities in the Microsoft .NET Common Language Runtime Could Allow Remote Code Execution (974378)

Source: CCN
Type: Microsoft Security Bulletin MS10-041
Vulnerabilities in the Microsoft .NET Framework Could Allow Tampering (981343)

Source: CCN
Type: Microsoft Security Bulletin MS10-060
Vulnerabilities in the Microsoft .NET Common Language Runtime and in Microsoft Silverlight Could Allow Remote Code Execution (2265906)

Source: CCN
Type: Microsoft Security Bulletin MS11-044
Vulnerability in .NET Framework Could Allow Remote Code Execution (2538814)

Source: CCN
Type: Microsoft Security Bulletin MS11-078
Vulnerability in .NET Framework and Microsoft Silverlight Could Allow Remote Code Execution (2604930)

Source: CCN
Type: BID-36611
Microsoft .NET Framework Pointer Verification Remote Code Execution Vulnerability

Source: CERT
Type: US Government Resource
TA09-286A

Source: MS
Type: UNKNOWN
MS09-061

Source: XF
Type: UNKNOWN
dotnet-cas-code-execution(48293)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:5716

Source: CCN
Type: IBM Security Bulletin 1138588 (Cognos Analytics)
IBM Cognos Analytics has addressed multiple vulnerabilties

Source: CCN
Type: IBM Security Bulletin 1142626 (Cognos Business Intelligence)
IBM Cognos Business Intelligence has addressed multiple vulnerabilties

Vulnerable Configuration:

Configuration 1:

cpe:/o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*

AND

cpe:/a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*

OR cpe:/a:microsoft:.net_framework:2.0:sp1:*:*:*:*:*:*

OR cpe:/a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*

Configuration 2:

cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:itanium:*

OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x32:*

OR cpe:/o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:itanium:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:*

AND

cpe:/a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*

OR cpe:/a:microsoft:.net_framework:2.0:sp1:*:*:*:*:*:*

OR cpe:/a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*

OR cpe:/a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*

OR cpe:/a:microsoft:.net_framework:3.5:sp1:*:*:*:*:*:*

Configuration 3:

cpe:/o:microsoft:windows_vista:*:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:*:*:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:*:sp1:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:*:sp2:x64:*:*:*:*:*

AND

cpe:/a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*

OR cpe:/a:microsoft:.net_framework:2.0:-:*:*:*:*:*:*

OR cpe:/a:microsoft:.net_framework:2.0:sp1:*:*:*:*:*:*

OR cpe:/a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*

OR cpe:/a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*

OR cpe:/a:microsoft:.net_framework:3.5:sp1:*:*:*:*:*:*

Configuration 4:

cpe:/a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*

AND

cpe:/o:microsoft:windows_7:-:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:r2:itanium:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:r2:x64:*:*:*:*:*

Configuration 5:

cpe:/a:microsoft:.net_framework:1.0:sp3:*:*:*:*:*:*

OR cpe:/a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*

OR cpe:/a:microsoft:.net_framework:2.0:sp1:*:*:*:*:*:*

OR cpe:/a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*

OR cpe:/a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*

OR cpe:/a:microsoft:.net_framework:3.5:sp1:*:*:*:*:*:*

AND

cpe:/o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*

Configuration CCN 1:

cpe:/a:microsoft:.net_framework:1.0:sp3:*:*:*:*:*:*

OR cpe:/a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*

OR cpe:/a:microsoft:.net_framework:2.0:-:*:*:*:*:*:*

OR cpe:/a:microsoft:.net_framework:2.0:sp1:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x32:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:itanium:*

AND

cpe:/o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*

OR cpe:/o:microsoft:windows:xp:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:*:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows:server_2003:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows:server_2003:sp2:itanium:*:*:*:*:*

OR cpe:/o:microsoft:windows:server_2003:sp2:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:*:*:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows_xp::sp2:x64:*:professional:*:*:*

OR cpe:/o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:*:sp1:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:itanium:*

OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows:xp:sp3:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:*:sp2:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows_7:*:*:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows_7:-:*:*:*:*:*:x32:*

OR cpe:/o:microsoft:windows_server_2008:*:r2:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:r2:itanium:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:2005:sp2:tablet_pc:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:2005:sp3:tablet_pc:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:2005:sp2:media_center:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:2005:sp3:media_center:*:*:*:*:*

OR cpe:/a:ibm:cognos_business_intelligence:10.2.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:cognos_analytics:11.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:cognos_analytics:11.1:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:5716	V	Microsoft .NET Framework Pointer Verification Vulnerability	2014-08-18