.NET Core and Visual Studio Denial of Service Vulnerability

The version of Microsoft .NET Core SDK installed on the remote host is prior to 7.0.10. It is, therefore, affected by a denial-of-service (DoS) vulnerability. The vulnerability exists in .NET Kestrel where a malicious client can bypass QUIC stream limit in HTTP/3 in both ASP.NET and .NET runtimes resulting in denial of service.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6278-2 advisory.

    USN-6278-1 fixed several vulnerabilities in .NET. This update provides the corresponding updates for     Ubuntu 22.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - .NET Core and Visual Studio Denial of Service Vulnerability. (CVE-2023-38178)

  - .NET and Visual Studio Remote Code Execution Vulnerability. (CVE-2023-35390)

  - .NET and Visual Studio Denial of Service Vulnerability. (CVE-2023-38180)

  - ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability. (CVE-2023-35391)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6278-1 advisory.

    It was discovered that .NET did not properly handle the execution of certain commands. An attacker could     possibly use this issue to achieve remote code execution. (CVE-2023-35390)

    Benoit Foucher discovered that .NET did not properly implement the QUIC stream limit in HTTP/3. An     attacker could possibly use this issue to cause a denial of service. (CVE-2023-38178)

    It was discovered that .NET did not properly handle the disconnection of potentially malicious clients     interfacing with a Kestrel server. An attacker could possibly use this issue to cause a denial of service.
    (CVE-2023-38180)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2023_Aug_08 advisory.

  - .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2023-35390)

  - ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability (CVE-2023-35391)

  - .NET Core and Visual Studio Denial of Service Vulnerability (CVE-2023-38178)

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2023-38180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
180501	Security Update for .NET 7.0 Core SDK (CVE-2023-38178)	Nessus	Windows	high
179691	Ubuntu 22.04 LTS : .NET vulnerabilities (USN-6278-2)	Nessus	Ubuntu Local Security Checks	high
179645	Security Updates for Microsoft Visual Studio Products (August 2023)	Nessus	Windows : Microsoft Bulletins	high
179584	Ubuntu 23.04 : .NET vulnerabilities (USN-6278-1)	Nessus	Ubuntu Local Security Checks	high
179502	Security Update for Microsoft .NET Core (August 2023)	Nessus	Windows	high

Detections

Analytics

CVE-2023-38178

high

Tenable Plugins

high

high

high

high

high