Microsoft Identity Denial of service vulnerability

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0150 advisory.

    [8.0.101-1.0.1]
    - Add support for Oracle Linux
    - Update to .NET SDK 8.0.101 and Runtime 8.0.1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0150 advisory.

  - Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability     (CVE-2024-0056)

  - NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability (CVE-2024-0057)

  - Microsoft Identity Denial of service vulnerability (CVE-2024-21319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-489 advisory.

  - Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability     (CVE-2024-0056)

  - NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability (CVE-2024-0057)

  - Microsoft Identity Denial of service vulnerability (CVE-2024-21319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0157 advisory.

  - Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability     (CVE-2024-0056)

  - NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability (CVE-2024-0057)

  - Microsoft Identity Denial of service vulnerability (CVE-2024-21319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0158 advisory.

  - Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability     (CVE-2024-0056)

  - NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability (CVE-2024-0057)

  - Microsoft Identity Denial of service vulnerability (CVE-2024-21319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0158 advisory.

    [6.0.126-1.0.1]
    - Add support for Oracle Linux

    [6.0.126-1]
    - Update to .NET SDK 6.0.126 and Runtime 6.0.26

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0157 advisory.

    [7.0.115-1.0.1]
    - Add support for Oracle Linux
    - Update to .NET SDK 7.0.115 and Runtime 7.0.15

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0151 advisory.

    [7.0.115-1.0.1]
    - Update to .NET SDK 7.0.115 and Runtime 7.0.15

    [7.0.114-1.0.1]
    - Update to .NET SDK 7.0.114 and Runtime 7.0.14

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0152 advisory.

    [8.0.101-1.0.1]
    - Update to .NET SDK 8.0.101 and Runtime 8.0.1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0255 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.126 and .NET Runtime 6.0.26.

    The following packages have been upgraded to a later upstream version: rh-dotnet60-dotnet (6.0.126).
    (BZ#2255300)

    Security Fix(es):

    * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)

    * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0156 advisory.

    [6.0.126-1.0.1]
    - Add support for Oracle Linux

    [6.0.126-1]
    - Update to .NET SDK 6.0.126 and Runtime 6.0.26

    [6.0.125-1]
    - Update to .NET SDK 6.0.125 and Runtime 6.0.25

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:0150 advisory.

  - Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability     (CVE-2024-0056)

  - NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability (CVE-2024-0057)

  - Microsoft Identity Denial of service vulnerability (CVE-2024-21319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:0157 advisory.

  - Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability     (CVE-2024-0056)

  - NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability (CVE-2024-0057)

  - Microsoft Identity Denial of service vulnerability (CVE-2024-21319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:0158 advisory.

  - Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability     (CVE-2024-0056)

  - NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability (CVE-2024-0057)

  - Microsoft Identity Denial of service vulnerability (CVE-2024-21319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0158 advisory.

  - Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability     (CVE-2024-0056)

  - NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability (CVE-2024-0057)

  - Microsoft Identity Denial of service vulnerability (CVE-2024-21319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0157 advisory.

  - Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability     (CVE-2024-0056)

  - NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability (CVE-2024-0057)

  - Microsoft Identity Denial of service vulnerability (CVE-2024-21319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0150 advisory.

  - Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability     (CVE-2024-0056)

  - NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability (CVE-2024-0057)

  - Microsoft Identity Denial of service vulnerability (CVE-2024-21319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0156 advisory.

  - Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability     (CVE-2024-0056)

  - NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability (CVE-2024-0057)

  - Microsoft Identity Denial of service vulnerability (CVE-2024-21319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0152 advisory.

  - Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability     (CVE-2024-0056)

  - NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability (CVE-2024-0057)

  - Microsoft Identity Denial of service vulnerability (CVE-2024-21319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0151 advisory.

  - Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability     (CVE-2024-0056)

  - NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability (CVE-2024-0057)

  - Microsoft Identity Denial of service vulnerability (CVE-2024-21319)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6578-1 advisory.

    Vishal Mishra and Anita Gaud discovered that .NET did not properly validate X.509 certificates with     malformed signatures. An attacker could possibly use this issue to bypass an application's typical     authentication logic. (CVE-2024-0057)

    Morgan Brown discovered that .NET did not properly handle requests from unauthenticated clients. An     attacker could possibly use this issue to cause a denial of service. (CVE-2024-21319)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0156 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.126 and .NET Runtime 6.0.26.

    Security Fix(es):

    * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)

    * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0151 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 7.0.115 and .NET Runtime 7.0.15.

    Security Fix(es):

    * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)

    * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0157 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 7.0.115 and .NET Runtime 7.0.15.

    Security Fix(es):

    * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)

    * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0150 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.101 and .NET Runtime 8.0.1.

    Security Fix(es):

    * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)

    * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0158 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.126 and .NET Runtime 6.0.26.

    Security Fix(es):

    * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)

    * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0152 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.101 and .NET Runtime 8.0.1.

    Security Fix(es):

    * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)

    * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. They are, therefore, affected by multiple vulnerabilities, including:

  - Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (CVE-2023-29356, CVE-2023-32025,     CVE-2023-32026, CVE-2023-32027)

  - NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability (CVE-2024-0057)

  - Visual Studio Elevation of Privilege Vulnerability (CVE-2024-20656)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
190821	Oracle Linux 8 : .NET / 8.0 (ELSA-2024-0150)	Nessus	Oracle Linux Local Security Checks	critical
189768	CentOS 8 : .NET 8.0 (CESA-2024:0150)	Nessus	CentOS Local Security Checks	critical
189328	Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2024-489)	Nessus	Amazon Linux Local Security Checks	critical
189306	CentOS 8 : .NET 7.0 (CESA-2024:0157)	Nessus	CentOS Local Security Checks	critical
189305	CentOS 8 : .NET 6.0 (CESA-2024:0158)	Nessus	CentOS Local Security Checks	critical
189200	Oracle Linux 8 : .NET / 6.0 (ELSA-2024-0158)	Nessus	Oracle Linux Local Security Checks	critical
189164	Oracle Linux 8 : .NET / 7.0 (ELSA-2024-0157)	Nessus	Oracle Linux Local Security Checks	critical
189142	Oracle Linux 9 : .NET / 7.0 (ELSA-2024-0151)	Nessus	Oracle Linux Local Security Checks	critical
189141	Oracle Linux 9 : .NET / 8.0 (ELSA-2024-0152)	Nessus	Oracle Linux Local Security Checks	critical
188060	RHEL 7 : .NET 6.0 (RHSA-2024:0255)	Nessus	Red Hat Local Security Checks	critical
188025	Oracle Linux 9 : .NET / 6.0 (ELSA-2024-0156)	Nessus	Oracle Linux Local Security Checks	critical
188019	Rocky Linux 8 : .NET 8.0 (RLSA-2024:0150)	Nessus	Rocky Linux Local Security Checks	critical
188018	Rocky Linux 8 : .NET 7.0 (RLSA-2024:0157)	Nessus	Rocky Linux Local Security Checks	critical
188016	Rocky Linux 8 : .NET 6.0 (RLSA-2024:0158)	Nessus	Rocky Linux Local Security Checks	critical
188012	AlmaLinux 8 : .NET 6.0 (ALSA-2024:0158)	Nessus	Alma Linux Local Security Checks	critical
188011	AlmaLinux 8 : .NET 7.0 (ALSA-2024:0157)	Nessus	Alma Linux Local Security Checks	critical
188007	AlmaLinux 8 : .NET 8.0 (ALSA-2024:0150)	Nessus	Alma Linux Local Security Checks	critical
187985	AlmaLinux 9 : .NET 6.0 (ALSA-2024:0156)	Nessus	Alma Linux Local Security Checks	critical
187983	AlmaLinux 9 : .NET 8.0 (ALSA-2024:0152)	Nessus	Alma Linux Local Security Checks	critical
187982	AlmaLinux 9 : .NET 7.0 (ALSA-2024:0151)	Nessus	Alma Linux Local Security Checks	critical
187956	Ubuntu 22.04 LTS / 23.04 / 23.10 : .NET vulnerabilities (USN-6578-1)	Nessus	Ubuntu Local Security Checks	critical
187915	RHEL 9 : .NET 6.0 (RHSA-2024:0156)	Nessus	Red Hat Local Security Checks	critical
187914	RHEL 9 : .NET 7.0 (RHSA-2024:0151)	Nessus	Red Hat Local Security Checks	critical
187913	RHEL 8 : .NET 7.0 (RHSA-2024:0157)	Nessus	Red Hat Local Security Checks	critical
187911	RHEL 8 : .NET 8.0 (RHSA-2024:0150)	Nessus	Red Hat Local Security Checks	critical
187910	RHEL 8 : .NET 6.0 (RHSA-2024:0158)	Nessus	Red Hat Local Security Checks	critical
187909	RHEL 9 : .NET 8.0 (RHSA-2024:0152)	Nessus	Red Hat Local Security Checks	critical
187806	Security Updates for Microsoft Visual Studio Products (January 2024)	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2024-21319

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical