30 Marsh Wall,
E14 9TP London
+44 (1442) 245030
Context presents 'Breaking .NET Through Serialization' at Black Hat USA
Serialization vulnerabilities can lead to data disclosure or remote code execution warns Context in white paper published today
Earlier this year, Microsoft released a patch to mitigate the risks after Context made Microsoft aware of the .NET vulnerabilities and helped to fix the issues. The patch makes changes to the workings of the serialization framework, a fundamental feature of .NET applications that allows data or objects to be easily transferred and stored. The risks identified by Context could allow an attacker to target an application, either via a remote interface or through code running within a sandbox, in order to disclose information such as authentication details or to circumvent security measures to execute code under malicious control. The applications in question could be remotely accessible business services, local privileged applications or sandboxed environments such as XAML browser applications.
"The process of serialization is a fundamental function of a number of common application frameworks due to the power it provides a developer," says James Forshaw. "The .NET framework provides many such techniques to serialize the state of objects but by far the most powerful is the Binary Formatter, a set of functionality built into the framework since v1.0. The power provided by this serialization mechanism, the length of time it has been present, as well as the fact it is tied so closely into the .NET runtime, makes it a significant attack threat."
The Context whitepaper describes some of the fundamental vulnerabilities which allow remote code execution, privilege escalation and information disclosure attacks against not just sandboxed .NET code such as in the browser, but also remote network services using common framework libraries. Understanding the attack techniques, which could also apply to other serialization technologies, will help developers to avoid common mistakes with binary serialization, says Context.
For more information about the Black Hat USA 2012 in Las Vegas, from 21-26 July, please visit:https://www.blackhat.com/html/bh-us-12/bh-us-12-briefings.html#Forshaw
The Microsoft patch for these issues can be viewed and downloaded at: http://technet.microsoft.com/en-us/security/bulletin/ms12-035
For more information on Context, visit www.contextis.com
Die Nutzung von hier veröffentlichten Informationen zur Eigeninformation und redaktionellen Weiterverarbeitung ist in der Regel kostenfrei. Bitte klären Sie vor einer Weiterverwendung urheberrechtliche Fragen mit dem angegebenen Herausgeber. Bei Veröffentlichung senden Sie bitte ein Belegexemplar an email@example.com.