CVE-2013-3132: Code Injection

Published Jul 10, 2013

Updated

Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Delegate Reflection Bypass Vulnerability."

Affected Software

7 affected components

Microsoft .NET Framework=1.0-sp3

Microsoft .NET Framework=1.1-sp1

Microsoft .NET Framework=2.0-sp2

Microsoft .NET Framework=3.5

Microsoft .NET Framework=3.5.1

Microsoft .NET Framework=4.0

Microsoft .NET Framework=4.5

Event History

Jul 10, 2013

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-3132?

CVE-2013-3132 is classified as critical due to its potential for remote code execution.

How can I fix CVE-2013-3132?

To address CVE-2013-3132, you should apply the appropriate Microsoft security updates provided in the bulletin MS13-052.

What systems are affected by CVE-2013-3132?

CVE-2013-3132 affects various versions of the Microsoft .NET Framework, including 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5.

What type of attack can exploit CVE-2013-3132?

The vulnerability can be exploited through crafted XAML browser applications (XBAPs) or malicious .NET Framework applications.

How does CVE-2013-3132 affect application security?

CVE-2013-3132 compromises application security by allowing attackers to execute arbitrary code due to improper permission checks in reflection.