CVE-2013-3860: Input Validation

Published Oct 9, 2013

Updated

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly parse a DTD during XML digital-signature validation, which allows remote attackers to cause a denial of service (application crash or hang) via a crafted signed XML document, aka "Entity Expansion Vulnerability."

Affected Software

6 affected components

Microsoft .NET Framework=2.0-sp2

Microsoft .NET Framework=3.5

Microsoft .NET Framework=3.5-sp1

Microsoft .NET Framework=3.5.1

Microsoft .NET Framework=4.0

Microsoft .NET Framework=4.5

Event History

Oct 9, 2013

CVE Published

via MITRE·02:44 PM

Data Sourced

via MITRE·02:44 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-3860?

CVE-2013-3860 is considered a critical severity vulnerability due to its potential to cause denial of service.

How do I fix CVE-2013-3860?

The recommended fix for CVE-2013-3860 is to apply the latest Microsoft updates and patches for the affected .NET Framework versions.

What versions of Microsoft .NET Framework are affected by CVE-2013-3860?

CVE-2013-3860 affects Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5.

What is the nature of the vulnerability described in CVE-2013-3860?

CVE-2013-3860 involves improper parsing of a DTD during XML digital-signature validation, leading to application crashes or hangs.

Can CVE-2013-3860 be exploited remotely?

Yes, CVE-2013-3860 can be exploited remotely through a crafted signed XML document.