SMB: Microsoft .NET Framework Mscoreei Insecure Library Load

This signature detects an attempt to exploit a known vulnerability against Microsoft .NET framework while loading certain library files. Successful exploitation could allow an attacker to run arbitrary commands which could lead to further attacks.

Extended Description

Microsoft .NET Framework 4.6 and 4.6.1 mishandles library loading, which allows local users to gain privileges via a crafted application, aka ".NET Framework Remote Code Execution Vulnerability."

Affected Products

Microsoft .net_framework

References

CVE: CVE-2016-0148

URL: https://technet.microsoft.com/en-us/library/security/ms16-041 http://www.zerodayinitiative.com/advisories/zdi-16-234/ https://technet.microsoft.com/library/security/ms16-041 https://www.securify.nl/advisory/sfy20160201/_net_framework_4_6_allows_side_loading_of_windows_api_set_dll.html

Short Name

SMB:EXPLOIT:MSCOREDLL-LOAD

Severity

Minor

Recommended

True

Recommended Action

Drop

SMB: Microsoft .NET Framework Mscoreei Insecure Library Load

Extended Description

Affected Products

References

Found a potential security threat?