CVE-2013-3133: Code Injection

Published Jul 10, 2013

Updated

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Anonymous Method Injection Vulnerability."

Affected Software

5 affected components

Microsoft .NET Framework=2.0-sp2

Microsoft .NET Framework=3.5

Microsoft .NET Framework=3.5.1

Microsoft .NET Framework=4.0

Microsoft .NET Framework=4.5

Event History

Jul 10, 2013

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-3133?

CVE-2013-3133 has a critical severity rating due to its potential to allow remote code execution.

How do I fix CVE-2013-3133?

To fix CVE-2013-3133, apply the Microsoft security updates provided in MS13-052 for affected versions of .NET Framework.

Which versions of .NET Framework are affected by CVE-2013-3133?

CVE-2013-3133 affects Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, 4.0, and 4.5.

What type of attack does CVE-2013-3133 enable?

CVE-2013-3133 enables attackers to execute arbitrary code remotely through crafted XAML browser applications or .NET applications.

Is user interaction required to exploit CVE-2013-3133?

Yes, exploiting CVE-2013-3133 typically requires user interaction, such as running a malicious application or visiting a compromised website.