CVE-2013-3171: Code Injection

Published Jul 10, 2013

Updated

The serialization functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly check the permissions of delegate objects, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages a partial-trust relationship, aka "Delegate Serialization Vulnerability."

Affected Software

6 affected components

Microsoft .NET Framework=2.0-sp2

Microsoft .NET Framework=3.5

Microsoft .NET Framework=3.5-sp1

Microsoft .NET Framework=3.5.1

Microsoft .NET Framework=4.0

Microsoft .NET Framework=4.5

Event History

Jul 10, 2013

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-3171?

CVE-2013-3171 has a critical severity rating due to its potential for allowing remote code execution.

How do I fix CVE-2013-3171?

To fix CVE-2013-3171, users should apply the latest security updates provided by Microsoft for the affected .NET Framework versions.

Which versions of .NET Framework are affected by CVE-2013-3171?

CVE-2013-3171 affects Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4.0, and 4.5.

What type of attack does CVE-2013-3171 enable?

CVE-2013-3171 can enable attackers to execute arbitrary code through specially crafted XAML browser applications.

Is there a workaround for CVE-2013-3171?

There are no recommended workarounds for CVE-2013-3171, the best mitigation is to apply security updates.