CVE-2009-3275

Blocks/Common/Src/Configuration/Manageability/Adm/AdmContentBuilder.cs in Microsoft patterns & practices Enterprise Library (aka EntLib) allows context-dependent attackers to cause a denial of service (CPU consumption) via an input string composed of many \ (backslash) characters followed by a " (double quote), related to a certain regular expression, aka a "ReDoS" vulnerability.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://www.checkmarx.com/Upload/Documents/PDF/Checkmarx_OWASP_IL_2009_ReDoS.pdf	Exploit
http://www.securityfocus.com/archive/1/506419/100/0/threaded
http://www.checkmarx.com/Upload/Documents/PDF/Checkmarx_OWASP_IL_2009_ReDoS.pdf	Exploit
http://www.securityfocus.com/archive/1/506419/100/0/threaded

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:enterprise_library:3.1:::::::*
	cpe:2.3:a:microsoft:enterprise_library:4.0:::::::*
	cpe:2.3:a:microsoft:enterprise_library:4.1:::::::*

History

21 Nov 2024, 01:06

Type	Values Removed	Values Added
References	~~() http://www.checkmarx.com/Upload/Documents/PDF/Checkmarx_OWASP_IL_2009_ReDoS.pdf - Exploit~~	() http://www.checkmarx.com/Upload/Documents/PDF/Checkmarx_OWASP_IL_2009_ReDoS.pdf - Exploit
References	~~() http://www.securityfocus.com/archive/1/506419/100/0/threaded -~~	() http://www.securityfocus.com/archive/1/506419/100/0/threaded -

Information

Published : 2009-09-21 19:30

Updated : 2024-11-21 01:06

NVD link : CVE-2009-3275

Mitre link : CVE-2009-3275

CVE.ORG link : CVE-2009-3275

JSON object : View

Products Affected

microsoft

enterprise_library

CWE

CWE-134

Use of Externally-Controlled Format String

{"id": "CVE-2009-3275", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-09-21T19:30:00.547", "references": [{"url": "http://www.checkmarx.com/Upload/Documents/PDF/Checkmarx_OWASP_IL_2009_ReDoS.pdf", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/506419/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.checkmarx.com/Upload/Documents/PDF/Checkmarx_OWASP_IL_2009_ReDoS.pdf", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/506419/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-134"}]}], "descriptions": [{"lang": "en", "value": "Blocks/Common/Src/Configuration/Manageability/Adm/AdmContentBuilder.cs in Microsoft patterns & practices Enterprise Library (aka EntLib) allows context-dependent attackers to cause a denial of service (CPU consumption) via an input string composed of many \\ (backslash) characters followed by a \" (double quote), related to a certain regular expression, aka a \"ReDoS\" vulnerability."}, {"lang": "es", "value": "Blocks/Common/Src/Configuration/Manageability/Adm/AdmContentBuilder.cs en Microsoft patterns & practices Enterprise Library (tambi\u00e9n conocido como EntLib) permite a los atacantes dependientes del contexto provocar una denegaci\u00f3n de servicio (consumo de CPU) mediante un cadena de entrada compuesta por muchos caracteres \\ (barra invertida) seguidos de un car\u00e1cter \" (comillas dobles\"), relacionado con cierta expresi\u00f3n regular, tambi\u00e9n conocido como vulnerabilidad \"ReDoS\" (Denegaci\u00f3n de servicio mediante expresi\u00f3n regular)."}], "lastModified": "2024-11-21T01:06:57.787", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:enterprise_library:3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B9A6699-874A-4240-B138-3D9D790A70EC"}, {"criteria": "cpe:2.3:a:microsoft:enterprise_library:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "755CF81F-C9B7-4AA8-9EA0-167B096A6801"}, {"criteria": "cpe:2.3:a:microsoft:enterprise_library:4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A9738E2-E5D1-4082-991D-65CF7A5F49CD"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}