Multiple vulnerabilities in Microsoft .NET, .NET Framework and Visual Studio



Risk High
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2023-29331
CVE-2023-24897
CVE-2023-24895
CVE-2023-24936
CWE-ID CWE-20
CWE-264
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Microsoft .NET Framework
Server applications / Frameworks for developing and running applications

Visual Studio
Universal components / Libraries / Software for developers

.NET
Other software / Other software solutions

Vendor Microsoft

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU77235

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-29331

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in .NET, .NET Framework, and Visual Studio. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Microsoft .NET Framework: 2.0 - 4.8.1

Visual Studio: 17.0.0 17.0.31903.59 - 17.6.0 17.6.33712.159

.NET: 6.0.0 - 7.0.0

CPE2.3 External links

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-29331


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU77242

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2023-24897

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in .NET, .NET Framework, and Visual Studio. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Visual Studio: 16.0 - 2017 version 15.9

Microsoft .NET Framework: 3.5 - 4.8.1

.NET: 6.0.0 - 7.0.0

CPE2.3 External links

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-24897


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU77239

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2023-24895

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in .NET, .NET Framework, and Visual Studio. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Microsoft .NET Framework: 2.0 - 4.8.1

Visual Studio: 17.0.0 17.0.31903.59 - 17.6.0 17.6.33712.159

.NET: 6.0.0 - 7.0.0

CPE2.3
External links

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-24895


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU77237

Risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2023-24936

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in .NET, .NET Framework, and Visual Studio, which leads to security restrictions bypass and privilege escalation.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Microsoft .NET Framework: 2.0 - 4.8.1

Visual Studio: 17.0.0 17.0.31903.59 - 17.6.0 17.6.33712.159

.NET: 6.0.0 - 7.0.0

CPE2.3 External links

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-24936


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###