=====================================================================

                           CERT-Renater

               Note d'Information No. 2014/VULN163
_____________________________________________________________________

DATE                : 12/08/2014

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S):  Windows version Server 2003, Vista, Server 2008,
              7, 8, 8.1, Server 2012, RT, RT 8.1 running Microsoft .NET.

======================================================================
KB2984625
https://technet.microsoft.com/library/security/ms14-046
______________________________________________________________________

 Microsoft Security Bulletin MS14-046 - Important Vulnerability in .NET
Framework Could Allow Security Feature Bypass (2984625)

Published: August 12, 2014

Version: 1.0

General Information

Executive Summary

This security update resolves a privately reported vulnerability in
Microsoft .NET Framework. The vulnerability could allow security
feature bypass if a user visits a specially crafted website. In a
web-browsing attack scenario, an attacker who successfully exploited
this vulnerability could bypass the Address Space Layout Randomization
(ASLR) security feature, which helps protect users from a broad class
of vulnerabilities. The security feature bypass by itself does not
allow arbitrary code execution. However, an attacker could use this
ASLR bypass vulnerability in conjunction with another vulnerability,
such as a remote code execution vulnerability, that could take
advantage of the ASLR bypass to run arbitrary code.

This security update is rated Important for Microsoft .NET Framework
2.0 Service Pack 2, Microsoft .NET Framework 3.0 Service Pack 2,
Microsoft .NET Framework 3.5, and Microsoft .NET Framework 3.5.1 on
affected releases of Microsoft Windows.


Affected Software

Windows Server 2003

Windows Vista

Windows Server 2008

Windows 7

Windows 8 & 8.1

Windows Server 2012 and Windows Server 2012 R2

Windows RT and Windows RT 8.1


Vulnerability Information

NET ASLR Vulnerability - CVE-2014-4062

A security feature bypass vulnerability exists in the Microsoft .NET
Framework that could allow an attacker to bypass the Address Space
Layout Randomization (ASLR) security feature, which helps protect users
from a broad class of vulnerabilities. The security feature bypass by
itself does not allow arbitrary code execution. However, an attacker
could use this ASLR bypass vulnerability in conjunction with another
vulnerability, such as a remote code execution vulnerability, that
could take advantage of the ASLR bypass to run arbitrary code.

To view this vulnerability as a standard entry in the Common
Vulnerabilities and Exposures list, see CVE-2014-4062.


=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================