.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-242 advisory.

  - .NET Denial of Service Vulnerability (CVE-2023-21538)

  - .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2023-24895)

  - .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability (CVE-2023-24936)

  - .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability (CVE-2023-29331)

  - NuGet Client Remote Code Execution Vulnerability (CVE-2023-29337)

  - .NET and Visual Studio Elevation of Privilege Vulnerability (CVE-2023-32032, CVE-2023-33135)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft .NET Framework installation on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities, as follows:

  - A remote code execution vulnerability in the MSDIA SDK where corrupted PDBs can cause a heap overflow.
   (CVE-2023-24897)

  - A remote code execution vulnerability in WPF where the BAML offers other ways to instantiate types.
    (CVE-2023-21808)

  - A remote code execution vulnerability in the WPF XAML parser (CVE-2023-24895)

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability in the MSDIA SDK where corrupted PDBs can cause heap overflow,     leading to a crash or remote code execution. (CVE-2023-24897)

  - A remote code execution vulnerability where specially crafted input to git apply -reject can lead to     controlled content writes at arbitrary locations. (CVE-2023-25652)

  - A spoofing vulnerability where Github localization messages refer to a hard-coded path instead of     respecting the runtime prefix that leads to out-of-bound memory writes and crashes. (CVE-2023-25815)

  - An Out-Of-Bounds Write Vulnerability in Autodesk FBX SDK version 2020 or prior may lead to code     execution through maliciously crafted FBX files or information disclosure. (CVE-2023-27909)

  - An information disclosure vulnerability where a user may be tricked into opening a malicious     FBX file. This may exploit a stack buffer overflow (CVE-2023-27910) or heap buffer overflow     (CVE-2023-27911) vulnerability in Autodesk FBX SDK 2020 or prior which may lead to remote code     execution. 

  - A remote code execution vulnerability where a configuration file containing a logic error results     in arbitrary configuration injection. (CVE-2023-29007)

  - A remote code execution vulnerability where the Git for Windows executable responsible for     implementing a SOCKS5 proxy is susceptible to picking up an untrusted configuration on multi-user     machines. (CVE-2023-29011)

  - A remote code execution vulnerability where the Git for Windows Git CMD program incorrectly     searches for a program upon startup, leading to silent arbitrary code execution. (CVE-2023-29012)

  - A remote code execution vulnerability in the .NET SDK during tool restore which can lead to an     elevation of privilege. (CVE-2023-33135)

  - An information disclosure vulnerability by the obj file parser in Visual Studio. (CVE-2023-33139)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
178608	Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2023-242)	Nessus	Amazon Linux Local Security Checks	high
177393	Security Updates for Microsoft .NET Framework (June 2023)	Nessus	Windows : Microsoft Bulletins	high
177249	Security Updates for Microsoft Visual Studio Products (June 2023)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2023-24895

high

Tenable Plugins

high

high

high