.NET and Visual Studio Denial of Service Vulnerability

The Microsoft Visual Studio Products are missing security updates. They are, therefore, affected by multiple vulnerabilities, including:

  - A remote unauthenticated attacker could exploit this vulnerability by sending specially crafted requests     to a .NET vulnerable webapp or loading a specially crafted file into a vulnerable application. (CVE-2024-43498)   
  - The NrbfDecoder component in .NET 9 contains a denial of service vulnerability due to     incorrect input validation. (CVE-2024-43499)

  - Elevation of Privilege Vulnerability in Visual Studio C++ Redistributable Installer (CVE-2024-43590)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7105-1 advisory.

    It was discovered that the NrbfDecoder component in .NET did not properly handle an instance of a type     confusion vulnerability. An authenticated attacker could possibly use this issue to gain the privileges of     another user and execute arbitrary code. (CVE-2024-43498)

    It was discovered that the NrbfDecoder component in .NET did not properly perform input validation. An     unauthenticated remote attacker could possibly use this issue to cause a denial of service.
    (CVE-2024-43499)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of .NET Core SDK installed on the remote host is 9.x prior to 9.0.0. It is, therefore, affected by denial of service vulnerability as referenced in the October 2024 advisory:

  - .NET Remote Code Execution (CVE-2024-43498)

  - .NET Denial of Service Vulnerability (CVE-2024-43499)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210895	Security Updates for Microsoft Visual Studio Products (November 2024)	Nessus	Windows : Microsoft Bulletins	critical
210871	Ubuntu 24.10 : .NET vulnerabilities (USN-7105-1)	Nessus	Ubuntu Local Security Checks	critical
210867	Security Update for Microsoft .NET Core SDK (November 2024)	Nessus	Windows	critical

Detections

Analytics

CVE-2024-43499

high

Tenable Plugins

critical

critical

critical