Context presents 'Breaking .NET Through Serialization' at Black Hat USA

Serialization vulnerabilities can lead to data disclosure or remote code execution warns Context in white paper published today

(PresseBox) ( London, )
Tomorrow at the Black Hat USA conference in Las Vegas, James Forshaw, a Principal Security Consultant at Context Information Security, will be presenting details of vulnerabilities discovered in the .NET framework that allow malicious remote code execution from within .NET applications. His paper, 'Breaking .NET Through Serialization' is also published today at: www.contextis.co.uk/research/white-papers/areyoumytype

Earlier this year, Microsoft released a patch to mitigate the risks after Context made Microsoft aware of the .NET vulnerabilities and helped to fix the issues. The patch makes changes to the workings of the serialization framework, a fundamental feature of .NET applications that allows data or objects to be easily transferred and stored. The risks identified by Context could allow an attacker to target an application, either via a remote interface or through code running within a sandbox, in order to disclose information such as authentication details or to circumvent security measures to execute code under malicious control. The applications in question could be remotely accessible business services, local privileged applications or sandboxed environments such as XAML browser applications.

"The process of serialization is a fundamental function of a number of common application frameworks due to the power it provides a developer," says James Forshaw. "The .NET framework provides many such techniques to serialize the state of objects but by far the most powerful is the Binary Formatter, a set of functionality built into the framework since v1.0. The power provided by this serialization mechanism, the length of time it has been present, as well as the fact it is tied so closely into the .NET runtime, makes it a significant attack threat."

The Context whitepaper describes some of the fundamental vulnerabilities which allow remote code execution, privilege escalation and information disclosure attacks against not just sandboxed .NET code such as in the browser, but also remote network services using common framework libraries. Understanding the attack techniques, which could also apply to other serialization technologies, will help developers to avoid common mistakes with binary serialization, says Context.

For more information about the Black Hat USA 2012 in Las Vegas, from 21-26 July, please visit:https://www.blackhat.com/html/bh-us-12/bh-us-12-briefings.html#Forshaw

The Microsoft patch for these issues can be viewed and downloaded at: http://technet.microsoft.com/en-us/security/bulletin/ms12-035

For more information on Context, visit www.contextis.com
Für die oben stehenden Pressemitteilungen, das angezeigte Event bzw. das Stellenangebot sowie für das angezeigte Bild- und Tonmaterial ist allein der jeweils angegebene Herausgeber (siehe Firmeninfo bei Klick auf Bild/Meldungstitel oder Firmeninfo rechte Spalte) verantwortlich. Dieser ist in der Regel auch Urheber der Pressetexte sowie der angehängten Bild-, Ton- und Informationsmaterialien.
Die Nutzung von hier veröffentlichten Informationen zur Eigeninformation und redaktionellen Weiterverarbeitung ist in der Regel kostenfrei. Bitte klären Sie vor einer Weiterverwendung urheberrechtliche Fragen mit dem angegebenen Herausgeber. Bei Veröffentlichung senden Sie bitte ein Belegexemplar an service@pressebox.de.