MS15-101: Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (3089662)

high Nessus Plugin ID 85847


The version of the .NET Framework installed on the remote host is affected by multiple vulnerabilities.


The remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities in the Microsoft .NET Framework :

- An elevation of privilege vulnerability exists due to improper validation of the number of objects in memory before they are copied into an array. A remote, unauthenticated attacker can exploit this to bypass Code Access Security (CAS) restrictions by convincing a user to run an untrusted .NET application or to visit a website containing a malicious XAML browser application.

- A denial of service vulnerability exists due to improper handling of specially crafted requests to an ASP .NET server. A remote, unauthenticated attacker can exploit this to degrade performance. (CVE-2015-2526)


Microsoft has released a set of patches for .NET Framework 2.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6.

See Also

Plugin Details

Severity: High

ID: 85847

File Name: smb_nt_ms15-101.nasl

Version: 1.12

Type: local

Agent: windows

Published: 9/8/2015

Updated: 5/15/2020

Risk Information


Risk Factor: Medium

Score: 5.9


Risk Factor: High

Base Score: 9.3

Temporal Score: 7.3

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: E:POC/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/o:microsoft:windows, cpe:/a:microsoft:.net_framework

Required KB Items: SMB/MS_Bulletin_Checks/Possible

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/8/2015

Vulnerability Publication Date: 9/8/2015

Reference Information

CVE: CVE-2015-2504, CVE-2015-2526

BID: 76560, 76567