A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:2731 advisory.

  - dotnet: System.Net.Sockets.dll Socket.ConnectAsync Denial of Service (CVE-2019-1301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2732 advisory.

    .NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several     new APIs, and it includes a CLR implementation.

    New versions of .NET Core that address security vulnerabilities are now available. The updated versions     are .NET Core 2.1.13, and 2.2.7.

    Security Fix(es):

    * dotnet: System.Net.Sockets.dll Socket.ConnectAsync Denial of Service (CVE-2019-1301)

    Default inclusions for applications built with .NET Core have been updated to reference the newest     versions and their security fixes.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2731 advisory.

    NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several     new APIs, and it includes a CLR implementation.

    New versions of .NET Core that address security vulnerabilities are now available. The updated versions     are .NET Core SDK 2.1.509 and Runtime 2.1.13.

    Security Fix(es):

    * dotnet: System.Net.Sockets.dll Socket.ConnectAsync Denial of Service (CVE-2019-1301)

    Default inclusions for applications built with .NET Core have been updated to reference the newest     versions and their security fixes.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-2731 advisory.

    [2.1.509-1]
    - Update to .NET Core Runtime 2.1.13 and SDK 2.1.509
    - Resolves: RHBZ#1747874

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft .NET Core SDK installation on the remote host is version 2.1.x < 2.1.509, or 2.1.606 or 2.1.802, 2.2.x < 2.2.109 or 2.2.206 or 2.2.302.
It is, therefore, affected by multiple vulnerabilities: 

  - A denial of service vulnerability when .Net Core improperly handles     web requests. An unauthenticated, remote attacker     could exploit this issue, to cause a denial of service attack against     a .Net Core web application. (CVE-2019-1301)

  - An elevation of privilege vulnerability that could lead to     a content injection attack enabling an attacker to run a script     in the context of the logged-on user. An unauthenticated, remote attacker     could exploit this issue, via a link that has a specially crafted URL,     and convince the user to click the link. (CVE-2019-1302)

The Microsoft .NET Core installation on the remote host is version 2.1.x < 2.1.13, or 2.2.x < 2.2.7. It is, therefore, affected by a denial-of-service vulnerability when .Net Core improperly handles web requests. An unauthenticated, remote attacker could exploit this issue, to cause a denial of service attack against a .Net Core web application.

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly     impersonates certain file operations. An attacker who successfully exploited this vulnerability could gain     elevated privileges. An attacker with unprivileged access to a vulnerable system could exploit this vulnerability.
    The security update addresses the vulnerability by ensuring the Diagnostics Hub Standard Collector Service     properly impersonates file operations. (CVE-2019-1232)

  - A denial of service vulnerability exists when .NET Core improperly handles web requests. An attacker who     successfully exploited this vulnerability could cause a denial of service against a .NET Core web application.
    The vulnerability can be exploited remotely, without authentication. The update addresses the vulnerability by     correcting how the .NET Core web application handles web requests. (CVE-2019-1301)

ID	Name	Product	Family	Severity
145611	CentOS 8 : .NET Core on Red Hat Enterprise Linux (CESA-2019:2731)	Nessus	CentOS Local Security Checks	high
128856	RHEL 7 : .NET Core on Red Hat Enterprise Linux (RHSA-2019:2732)	Nessus	Red Hat Local Security Checks	high
128855	RHEL 8 : .NET Core on Red Hat Enterprise Linux (RHSA-2019:2731)	Nessus	Red Hat Local Security Checks	high
128848	Oracle Linux 8 : .NET / Core / on / Red / Hat / Enterprise / Linux (ELSA-2019-2731)	Nessus	Oracle Linux Local Security Checks	high
128772	Security Update for .NET Core SDK (Sep 2019)	Nessus	Windows	high
128771	Security Update for .NET Core (Sep 2019)	Nessus	Windows	high
128708	Security Updates for Microsoft Visual Studio Products (September 2019)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2019-1301

high

Tenable Plugins

high

high

high

high

high

high

high