Vulnerability Name:

CVE-2011-1978 (CCN-68828)

Assigned:2011-08-09
Published:2011-08-09
Updated:2020-09-28
Summary:Microsoft .NET Framework 2.0 SP2, 3.5.1, and 4 does not properly validate the System.Net.Sockets trust level, which allows remote attackers to obtain sensitive information or trigger arbitrary outbound network traffic via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka "Socket Restriction Bypass Vulnerability."
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-200
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2011-1978

Source: CCN
Type: SA45517
Microsoft .NET Framework Socket Restriction Bypass Vulnerability

Source: CCN
Type: Microsoft Security Bulletin MS12-016
Vulnerabilities in .NET Framework and Microsoft Silverlight Could Allow Remote Code Execution (2651026)

Source: CCN
Type: Microsoft Security Bulletin MS12-074
Vulnerabilities in .NET Framework Could Allow Remote Code Execution (2745030)

Source: CCN
Type: Microsoft Security Bulletin MS13-004
Vulnerability in .NET Framework Could Allow Elevation of Privilege (2769324)

Source: CCN
Type: Microsoft Security Bulletin MS14-057
Vulnerabilities in .NET Framework Could Allow Remote Code Execution (3000414)

Source: CCN
Type: Microsoft Security Bulletin MS15-118
Security Updates for .NET Framework to Address Elevation of Privilege (3104507)

Source: CCN
Type: Microsoft Security Bulletin MS16-065
Security Update for .NET Framework (3156757)

Source: CCN
Type: Microsoft Security Bulletin MS11-069
Vulnerability in .NET Framework Could Allow Information Disclosure (2567951)

Source: CCN
Type: BID-48991
Microsoft .NET Framework 'System.Net.Sockets' Namespace Security Bypass Vulnerability

Source: MS
Type: UNKNOWN
MS11-069

Source: XF
Type: UNKNOWN
ms-dotnet-socket-info-disc(68828)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:12901

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:.net_framework:4.0:-:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_7:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_7:-:sp1:*:*:ultimate_n:*:x86:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*
  • OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:sp2:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_7:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*
  • OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*

    • Configuration 3:
  • cpe:/a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:itanium:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:sp2:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_framework:4.0:-:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:12901
    V
    		Socket Restriction Bypass Vulnerability
    2014-08-18
    BACK
    microsoft .net framework 4.0
    microsoft windows 2003 server * sp2
    microsoft windows 7 -
    microsoft windows 7 - sp1
    microsoft windows server 2003 * sp2
    microsoft windows server 2008 * sp2
    microsoft windows server 2008 * sp2
    microsoft windows server 2008 - sp2
    microsoft windows server 2008 r2
    microsoft windows server 2008 r2
    microsoft windows vista * sp2
    microsoft windows vista * sp2
    microsoft windows xp * sp3
    microsoft windows xp - sp2
    microsoft .net framework 3.5.1
    microsoft windows 7 -
    microsoft windows server 2008 r2
    microsoft windows server 2008 r2
    microsoft .net framework 2.0 sp2
    microsoft windows 2003 server * sp2
    microsoft windows server 2003 * sp2
    microsoft windows server 2008 *
    microsoft windows server 2008 * sp2
    microsoft windows server 2008 * sp2
    microsoft windows server 2008 - sp2
    microsoft windows vista * sp2
    microsoft windows vista * sp2
    microsoft windows xp * sp3
    microsoft windows xp - sp2
    microsoft .net framework 2.0 sp2
    microsoft .net framework 3.5.1
    microsoft .net framework 4.0