The PE Loader service in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to execute arbitrary code via unspecified vectors involving an "unchecked buffer" and unvalidated message lengths, probably a buffer overflow.

The remote host is running a version of the ASP.NET framework that contains multiple vulnerabilities :

- PE Loader Vulnerability: could allow an attacker to execute arbitrary code with the privilege of the logged-on user;

- ASP.NET NULL Byte Termination Vulnerability: could allow an attacker to retrieve the content of the web server;

- JIT Compiler Vulnerability: could allow an attacker to execute arbitrary code with the privilege of the logged-on user.

The remote web server is running a version of the ASP.NET framework that contains multiple vulnerabilities :

  - A PE Loader vulnerability could allow an attacker to     execute arbitrary code with the privilege of the     logged-on user.

  - A ASP.NET NULL byte termination vulnerability could     allow an attacker to retrieve contents from the web     server.

  - A JIT compiler vulnerability could allow an attacker to     execute arbitrary code with the privilege of the     logged-on user.

The remote host is running a version of the ASP.NET framework that contains multiple vulnerabilities :

  - A PE Loader vulnerability could allow an attacker to     execute arbitrary code with the privileges of the     logged-on user.

  - An ASP.NET NULL byte termination vulnerability could     allow an attacker to retrieve the content of the web     server.

  - A JIT compiler vulnerability could allow an attacker to     execute arbitrary code with the privileges of the     logged-on user.

ID	Name	Product	Family	Severity
4121	Microsoft .NET Framework Remote Code Execution Vulnerabilities (931212)	Nessus Network Monitor	CGI	medium
4120	Microsoft .NET Framework Remote Code Execution Vulnerabilities (931212)	Nessus Network Monitor	CGI	medium
4119	Microsoft .NET Framework Remote Code Execution Vulnerabilities (931212)	Nessus Network Monitor	CGI	medium
25700	MS07-040: Vulnerabilities in .NET Framework Could Allow Remote Code Execution (931212) (uncredentialed check)	Nessus	Windows	high
25691	MS07-040: Vulnerabilities in .NET Framework Could Allow Remote Code Execution (931212)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2007-0041

critical

Tenable Plugins

medium

medium

medium

high

high