Visual Studio Denial of Service Vulnerability

The Microsoft .NET Framework installation on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities, as follows:

  - Denial of service vulnerability in Microsoft .NET Framework. (CVE-2023-36042, CVE-2024-21312)

  - Security feature bypass in System.Data.SqlClient SQL data provider. An attacker can perform a     man-in-the-middle attack on the connection between the client and server in order to read and modify the     TLS traffic. (CVE-2024-0056)

  - Security feature bypass in applications that use the X.509 chain building APIs. When processing an     untrusted certificate with malformed signatures, the framework returns an incorrect reason code.
    Applications which make use of this reason code may treat this scenario as a successful chain build,     potentially bypassing the application's typical authentication logic. (CVE-2024-0057)

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising the integrity of the system/application. (CVE-2023-36558)

  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. (CVE-2023-36049)

  - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected component to     deny system or application services. (CVE-2023-36038, CVE-2023-36042)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
187901	Security Updates for Microsoft .NET Framework (January 2024)	Nessus	Windows : Microsoft Bulletins	critical
185735	Security Updates for Microsoft Visual Studio Products (November 2023)	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2023-36042

medium

Tenable Plugins

critical

critical