Interpretation conflict in ASP.NET in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to access configuration files and obtain sensitive information, and possibly bypass security mechanisms that try to constrain the final substring of a string, via %00 characters, related to use of %00 as a string terminator within POSIX functions but a data character within .NET strings, aka "Null Byte Termination Vulnerability."

The remote host is running a version of the ASP.NET framework that contains multiple vulnerabilities :

- PE Loader Vulnerability: could allow an attacker to execute arbitrary code with the privilege of the logged-on user;

- ASP.NET NULL Byte Termination Vulnerability: could allow an attacker to retrieve the content of the web server;

- JIT Compiler Vulnerability: could allow an attacker to execute arbitrary code with the privilege of the logged-on user.

The remote web server is running a version of the ASP.NET framework that contains multiple vulnerabilities :

  - A PE Loader vulnerability could allow an attacker to     execute arbitrary code with the privilege of the     logged-on user.

  - A ASP.NET NULL byte termination vulnerability could     allow an attacker to retrieve contents from the web     server.

  - A JIT compiler vulnerability could allow an attacker to     execute arbitrary code with the privilege of the     logged-on user.

The remote host is running a version of the ASP.NET framework that contains multiple vulnerabilities :

  - A PE Loader vulnerability could allow an attacker to     execute arbitrary code with the privileges of the     logged-on user.

  - An ASP.NET NULL byte termination vulnerability could     allow an attacker to retrieve the content of the web     server.

  - A JIT compiler vulnerability could allow an attacker to     execute arbitrary code with the privileges of the     logged-on user.

ID	Name	Product	Family	Type	Severity
4121	Microsoft .NET Framework Remote Code Execution Vulnerabilities (931212)	Nessus Network Monitor	CGI		medium
4120	Microsoft .NET Framework Remote Code Execution Vulnerabilities (931212)	Nessus Network Monitor	CGI		medium
4119	Microsoft .NET Framework Remote Code Execution Vulnerabilities (931212)	Nessus Network Monitor	CGI		medium
25700	MS07-040: Vulnerabilities in .NET Framework Could Allow Remote Code Execution (931212) (uncredentialed check)	Nessus	Windows	Remote	high
25691	MS07-040: Vulnerabilities in .NET Framework Could Allow Remote Code Execution (931212)	Nessus	Windows : Microsoft Bulletins	Local	high

Detections

Analytics

CVE-2007-0042

high

Tenable Plugins

medium

medium

medium

high

high