Vulnerability Name:

CVE-2012-0160 (CCN-74375)

Assigned:2011-12-13
Published:2012-05-08
Updated:2018-10-12
Summary:Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5 SP1, 3.5.1, and 4 does not properly serialize input data, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka ".NET Framework Serialization Vulnerability."
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-20
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2012-0160

Source: CCN
Type: SA49117
Microsoft .NET Framework Two Serialization Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
49117

Source: CCN
Type: Microsoft Security Bulletin MS12-035
Vulnerabilities in .NET Framework Could Allow Remote Code Execution (2693777)

Source: BID
Type: UNKNOWN
53356

Source: CCN
Type: BID-53356
Microsoft .NET Framework Input Serialization CVE-2012-0160 Remote Code Execution Vulnerability

Source: SECTRACK
Type: UNKNOWN
1027036

Source: CERT
Type: US Government Resource
TA12-129A

Source: MS
Type: UNKNOWN
MS12-035

Source: XF
Type: UNKNOWN
ms-dotnet-serialization-code-exec(74375)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:15554

Source: CCN
Type: IBM Security Bulletin 1138588 (Cognos Analytics)
IBM Cognos Analytics has addressed multiple vulnerabilties

Source: CCN
Type: IBM Security Bulletin 1142626 (Cognos Business Intelligence)
IBM Cognos Business Intelligence has addressed multiple vulnerabilties

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:.net_framework:1.0:sp3:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_framework:3.5:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_framework:4.0:-:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:microsoft:.net_framework:1.0:sp3:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_framework:3.5:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_framework:4.0:-:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:cognos_business_intelligence:10.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_analytics:11.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_analytics:11.1.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:15554
    V
    		.NET Framework Serialization Vulnerability (CVE-2012-0160)
    2014-08-18
    BACK
    microsoft .net framework 1.0 sp3
    microsoft .net framework 1.1 sp1
    microsoft .net framework 2.0 sp2
    microsoft .net framework 3.0 sp2
    microsoft .net framework 3.5 sp1
    microsoft .net framework 3.5.1
    microsoft .net framework 4.0
    microsoft .net framework 1.0 sp3
    microsoft .net framework 1.1 sp1
    microsoft .net framework 2.0 sp2
    microsoft .net framework 3.5 sp1
    microsoft .net framework 3.5.1
    microsoft .net framework 4.0
    microsoft .net framework 3.0 sp2
    ibm cognos business intelligence 10.2.2
    ibm cognos analytics 11.0.0
    ibm cognos analytics 11.1.0