.NET and Visual Studio Remote Code Execution Vulnerability

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-9543 advisory.

    [9.0.100-1.0.1]
    - Add support for Oracle Linux

    [9.0.100-1]
    - Update to .NET SDK 9.0.100 and Runtime 9.0.0
    - Resolves: RHEL-65539

    [9.0.100~rc.2.24474.1-0.7]
    - Disable bootstrap
    - Related: RHEL-62776

    [9.0.100~rc.2.24474.1-0.6]
    - Rebootstrap
    - Related: RHEL-62776

    [9.0.100~rc.2.24474.1-0.5]
    - Add missing runtime dependencies to -aot- subpackage
    - Related: RHEL-62776

    [9.0.100~rc.2.24474.1-0.4]
    - Update to .NET SDK 9.0.100-rc.2.24474.1 and Runtime 9.0.0-rc.2.24473.5
    - Resolves: RHEL-62776

    [9.0.100~rc.1.24452.12-0.3]
    - Update to .NET SDK 9.0.100-rc.1.24452.12 and Runtime 9.0.0-rc.1.24431.7
    - Resolves: RHEL-59026

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:9543 advisory.

    * dotnet: Type confusion vulnerability leads to AV in .NET Core NrbfDecoder component (CVE-2024-43498)
      * dotnet: .NET Core - DoS - (unbounded work factor) in NrbfDecoder component (CVE-2024-43499)


    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.Security Fix(es):

      * dotnet: Type confusion vulnerability leads to AV in .NET Core NrbfDecoder component (CVE-2024-43498)
      * dotnet: .NET Core - DoS - (unbounded work factor) in NrbfDecoder component (CVE-2024-43499)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-70cf80279f advisory.

    This is the .NET 9.0 GA release.

    It contains security fixes for CVE-2024-43498 and CVE-2024-43499

    Announcement: https://devblogs.microsoft.com/dotnet/announcing-dotnet-9/

    Release Notes: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.0/9.0.0.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. They are, therefore, affected by multiple vulnerabilities, including:

  - A remote unauthenticated attacker could exploit this vulnerability by sending specially crafted requests     to a .NET vulnerable webapp or loading a specially crafted file into a vulnerable application. (CVE-2024-43498)   
  - The NrbfDecoder component in .NET 9 contains a denial of service vulnerability due to     incorrect input validation. (CVE-2024-43499)

  - Elevation of Privilege Vulnerability in Visual Studio C++ Redistributable Installer (CVE-2024-43590)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7105-1 advisory.

    It was discovered that the NrbfDecoder component in .NET did not properly handle an instance of a type     confusion vulnerability. An authenticated attacker could possibly use this issue to gain the privileges of     another user and execute arbitrary code. (CVE-2024-43498)

    It was discovered that the NrbfDecoder component in .NET did not properly perform input validation. An     unauthenticated remote attacker could possibly use this issue to cause a denial of service.
    (CVE-2024-43499)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of .NET Core SDK installed on the remote host is 9.x prior to 9.0.0. It is, therefore, affected by denial of service vulnerability as referenced in the October 2024 advisory:

  - .NET Remote Code Execution (CVE-2024-43498)

  - .NET Denial of Service Vulnerability (CVE-2024-43499)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211615	Oracle Linux 9 : .NET / 9.0 (ELSA-2024-9543)	Nessus	Oracle Linux Local Security Checks	critical
211577	AlmaLinux 9 : .NET 9.0 (ALSA-2024:9543)	Nessus	Alma Linux Local Security Checks	critical
211502	Fedora 40 : dotnet9.0 (2024-70cf80279f)	Nessus	Fedora Local Security Checks	critical
210895	Security Updates for Microsoft Visual Studio Products (November 2024)	Nessus	Windows : Microsoft Bulletins	critical
210871	Ubuntu 24.10 : .NET vulnerabilities (USN-7105-1)	Nessus	Ubuntu Local Security Checks	critical
210867	Security Update for Microsoft .NET Core SDK (November 2024)	Nessus	Windows	critical

Detections

Analytics

CVE-2024-43498

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical