CVEvulnerability
CVE-2007-0042
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2007-07-10
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.8 HIGH — AV:N/AC:L/Au:N/C:C/I:N/A:N
- Weaknesses
- CWE-200
Description
Interpretation conflict in ASP.NET in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to access configuration files and obtain sensitive information, and possibly bypass security mechanisms that try to constrain the final substring of a string, via %00 characters, related to use of %00 as a string terminator within POSIX functions but a data character within .NET strings, aka "Null Byte Termination Vulnerability."
Affected configurations
• microsoft .net framework 1.0
• microsoft .net framework 1.1
• microsoft .net framework 2.0
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html archive.cert.uni-stuttgart.de
- http://secunia.com/advisories/26003 Vendor Advisory
- http://security-assessment.com/files/advisories/2007-07-11_Multiple_.NET_Null_Byte_Injection_Vulnerabilities.pdf security-assessment.com
- http://www.securitytracker.com/id?1018356 www.securitytracker.com
- http://www.us-cert.gov/cas/techalerts/TA07-191A.html US Government Resource
- http://www.vupen.com/english/advisories/2007/2482 www.vupen.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-040 docs.microsoft.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2070 oval.cisecurity.org
- http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html archive.cert.uni-stuttgart.de
- http://secunia.com/advisories/26003 Vendor Advisory
- http://security-assessment.com/files/advisories/2007-07-11_Multiple_.NET_Null_Byte_Injection_Vulnerabilities.pdf security-assessment.com
- http://www.securitytracker.com/id?1018356 www.securitytracker.com
- http://www.us-cert.gov/cas/techalerts/TA07-191A.html US Government Resource
- http://www.vupen.com/english/advisories/2007/2482 www.vupen.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-040 docs.microsoft.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2070 oval.cisecurity.org