CVE-2012-4776 Information

Description

The Web Proxy Auto-Discovery (WPAD) functionality in Microsoft .NET Framework 2.0 SP2 3.5 3.5.1 4 and 4.5 does not validate configuration data that is returned during acquisition of proxy settings which allows remote attackers to execute arbitrary JavaScript code by providing crafted data during execution of (1) an XAML browser application (aka XBAP) or (2) a .NET Framework application aka \Web Proxy Auto-Discovery Vulnerability.\

Reference

http://osvdb.org/87266 http://secunia.com/advisories/51236 http://www.securityfocus.com/bid/56463 http://www.securitytracker.com/id?1027753 http://www.us-cert.gov/cas/techalerts/TA12-318A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-074 https://oval.cisecurity.org/repository/search/definition/oval3Aorg.mitre.oval3Adef3A15810