CVE:CVE-2009-0090
CNNVD:CNNVD-200910-207
Microsoft .NET Framework 1.0 SP3版本,1.1 SP1,和2.0 SP1版本没有验证.NET自变量代码，这会允许远程攻击者可以借助(1)一个特制的XAML浏览器应用程序(XBAP),(2)一个特制的ASP.NET应用程序或(3)一个特制的.NET框架应用程序,，获得没有预先设置的对栈内存的访问权,并执行任意代码，该漏洞又称"Microsoft .NET Framework指针验证漏洞"。
solution:Upgrade microsoft windows_2000 to a higher version than *:sp4,and avoid the version *:sp4; Upgrade microsoft .net_framework to a higher version than 1.1:sp1,2.0:sp1,2.0:sp2,3.5,3.5:sp1,2.0,1.0:sp3,and avoid the version 1.1:sp1,2.0:sp1,2.0:sp2,3.5,3.5:sp1,2.0,1.0:sp3; Upgrade microsoft windows_server_2003 to a higher version than *:sp2,and avoid the version *:sp2; Upgrade microsoft windows_server_2008 to a higher version than *,*:sp2,-:sp2,*:r2,and avoid the version *:sp2,-:sp2,*:r2; Upgrade microsoft windows_vista to a higher version than *,*:sp1,*:sp2,and avoid the version *:sp1,*:sp2; Upgrade microsoft windows_7 to a higher version than -; Upgrade microsoft windows_xp to a higher version than *:sp2,*:sp3,-:sp2,and avoid the version *:sp2,*:sp3,-:sp2