CVE-2012-0163: Input Validation

Published Apr 10, 2012

Updated

Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate function parameters, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework Parameter Validation Vulnerability."

Affected Software

7 affected components

Microsoft .NET Framework=1.0-sp3

Microsoft .NET Framework=1.1-sp1

Microsoft .NET Framework=2.0-sp2

Microsoft .NET Framework=3.5

Microsoft .NET Framework=3.5.1

Microsoft .NET Framework=4.0

Microsoft .NET Framework=4.5

Event History

Apr 10, 2012

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-0163?

CVE-2012-0163 is rated as critical due to its potential for remote code execution.

How do I fix CVE-2012-0163?

To fix CVE-2012-0163, you should apply the latest security updates provided by Microsoft for the affected .NET Framework versions.

Which versions of the .NET Framework are affected by CVE-2012-0163?

CVE-2012-0163 affects Microsoft .NET Framework versions 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5.

What types of attacks can exploit CVE-2012-0163?

CVE-2012-0163 can be exploited via crafted XAML browser applications, ASP.NET applications, or other .NET Framework applications.

Is there a workaround for CVE-2012-0163 if I can't apply the patch?

While updating is the best option, using application whitelisting to prevent execution of untrusted applications can serve as a temporary workaround.