KLA10925 Information Disclosure vulnerability in Microsoft .NET Framework 4.6.2

Mishandling of a developer-supplied key was found in Microsoft .NET 4.6.2 Framework’s Data Provider for SQL Server. By exploiting this vulnerability malicious users can obtain sensitive cleartext information. This vulnerability can be exploited remotely via leveraging key guessability.

Original advisories

https://technet.microsoft.com/library/security/ms16-155

CVE-2016-7270

Related products

Microsoft-.NET-Framework

CVE list

CVE-2016-7270 warning

KB list

3206632

3204801

3204802

3204805

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• Microsoft .NET Framework 4.6.2