Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-2497

The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0, 2.0 SP1, 2.0 SP2, 3.5, and 3.5 SP1, and Silverlight 2, does not properly handle interfaces, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP), (2) a crafted Silverlight application, (3) a crafted ASP.NET application, or (4) a crafted .NET Framework application, aka "Microsoft Silverlight and Microsoft .NET Framework CLR Vulnerability."

Published

2009-10-14T10:30:01.093

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 9.3 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

8.6

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-94
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System microsoft windows_2000 * Yes
Application microsoft .net_framework 2.0 Yes
Application microsoft .net_framework 2.0 Yes
Operating System microsoft windows_server_2003 * Yes
Operating System microsoft windows_server_2008 * Yes
Operating System microsoft windows_server_2008 * Yes
Operating System microsoft windows_server_2008 * Yes
Operating System microsoft windows_server_2008 * Yes
Operating System microsoft windows_server_2008 * Yes
Operating System microsoft windows_server_2008 - Yes
Operating System microsoft windows_server_2008 - Yes
Application microsoft .net_framework 1.1 Yes
Application microsoft .net_framework 2.0 Yes
Application microsoft .net_framework 2.0 Yes
Application microsoft .net_framework 3.5 Yes
Application microsoft .net_framework 3.5 Yes
Operating System microsoft windows_vista * Yes
Operating System microsoft windows_vista * Yes
Operating System microsoft windows_vista * Yes
Operating System microsoft windows_vista * Yes
Application microsoft .net_framework 1.1 Yes
Application microsoft .net_framework 2.0 Yes
Application microsoft .net_framework 2.0 Yes
Application microsoft .net_framework 2.0 Yes
Application microsoft .net_framework 3.5 Yes
Application microsoft .net_framework 3.5 Yes
Application microsoft .net_framework 1.1 Yes
Operating System microsoft windows_7 - Yes
Operating System microsoft windows_server_2008 * Yes
Operating System microsoft windows_server_2008 * Yes
Application microsoft .net_framework 1.0 Yes
Application microsoft .net_framework 1.1 Yes
Application microsoft .net_framework 2.0 Yes
Application microsoft .net_framework 2.0 Yes
Application microsoft .net_framework 3.5 Yes
Application microsoft .net_framework 3.5 Yes
Operating System microsoft windows_xp * Yes
Operating System microsoft windows_xp * Yes
Operating System microsoft windows_xp - Yes
References