CVE-2017-0160 Code injection in .NET Framework
Local attackers can execute arbitrary code on systems running Microsoft .NET Framework, requiring immediate patching by system administrators.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-0160?
CVE-2017-0160 is a high-severity code injection vulnerability in Microsoft .Net Framework, published on 12 Apr 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Microsoft .NET Framework 2.0, 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allows an attacker with access to the local system to execute malicious code, aka ".NET Remote Code Execution Vulnerability."
Which versions are affected by CVE-2017-0160?
It affects 1 product.
Products include Microsoft .Net Framework.
How do I fix CVE-2017-0160?
No fix has been published for CVE-2017-0160 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-0160 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-0160 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Microsoft .Net Framework
Sources
Also known as GHSA-fp95-p83c-7h99.