CVE-2007-0042

Interpretation conflict in ASP.NET in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to access configuration files and obtain sensitive information, and possibly bypass security mechanisms that try to constrain the final substring of a string, via %00 characters, related to use of %00 as a string terminator within POSIX functions but a data character within .NET strings, aka "Null Byte Termination Vulnerability."

• CWE-200

• http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html
• http://secunia.com/advisories/26003Vendor Advisory
• http://security-assessment.com/files/advisories/2007-07-11_Multiple_.NET_Null_Byte_Injection_Vulnerabilities.pdf
• http://www.securitytracker.com/id?1018356
• http://www.us-cert.gov/cas/techalerts/TA07-191A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2007/2482
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-040
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2070
• http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html
• http://secunia.com/advisories/26003Vendor Advisory
• http://security-assessment.com/files/advisories/2007-07-11_Multiple_.NET_Null_Byte_Injection_Vulnerabilities.pdf
• http://www.securitytracker.com/id?1018356
• http://www.us-cert.gov/cas/techalerts/TA07-191A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2007/2482
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-040
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2070

Published

Jul 10, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-0036Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2007-0037Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2007-0038Stack-based buffer overflow in the animated cursor code in M…
• CVE-2007-0039The Exchange Collaboration Data Objects (EXCDO) functionalit…
• CVE-2007-0040The LDAP service in Windows Active Directory in Microsoft Wi…
• CVE-2007-0041The PE Loader service in Microsoft .NET Framework 1.0, 1.1, …
• CVE-2007-0043The Just In Time (JIT) Compiler service in Microsoft .NET Fr…
• CVE-2007-0044Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, In…
• CVE-2007-0045Multiple cross-site scripting (XSS) vulnerabilities in Adobe…
• CVE-2007-0046Double free vulnerability in the Adobe Acrobat Reader Plugin…
• CVE-2007-0047CRLF injection vulnerability in Adobe Acrobat Reader Plugin …
• CVE-2007-0048Adobe Acrobat Reader Plugin before 8.0.0, and possibly the p…