CVE-2020-1066: .NET Framework Elevation of Privilege Vulnerability

Overview

Severity

N/A

Category

Elevation of Privilege

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2020-May

Released

2020-05-12

Last Updated

2020-05-14

EPSS Score

29.70% (percentile: 96.6%)

Description

An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level. To exploit the vulnerability, an attacker would first have to access the local machine, and then run a malicious program. The update addresses the vulnerability by correcting how .NET Framework activates COM objects.

Known Exploits (3)

• .NET Framework Elevation of Privilege Vulnerability — added 2020-08-09T05:48:10Z
• .NET Framework Elevation of Privilege Vulnerability — added 2020-06-01T12:38:51+08:00
• .NET Framework Elevation of Privilege Vulnerability — added 2020-06-01T04:44:05Z

Detection & Weaponization (1 sources)

Maturity: Exploit

• GitHub PoC: 2 repositories

Affected Products (6)

Developer Tools

• Microsoft .NET Framework 3.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2
• Microsoft .NET Framework 3.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2
• Microsoft .NET Framework 3.5.1 on Windows 7 for 32-bit Systems Service Pack 1
• Microsoft .NET Framework 3.5.1 on Windows 7 for x64-based Systems Service Pack 1
• Microsoft .NET Framework 3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Microsoft .NET Framework 3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Security Updates (4)

• 4556402
• 4556406
• 4556399
• 4556403

Acknowledgments

ChengBin Wang(<a href="https://github.com/cbwang505">@cbwang505</a>) from ZheJiang Guoli Security Technology

Revision History

• 2020-05-12: Information published.
• 2020-05-14: In the Security Updates table, removed Microsoft .NET Framework 3.5 installed on Windows Server 2008 for Itanium-based Systems and Microsoft .NET Framework 3.5.1 installed on Windows Server 2008 R2 for Itanium-based Systems as these versions are no longer supported.