.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly parsing certificate data. A denial of service vulnerability exists when .NET Core improperly handles parsing certificate data, aka ".NET CORE Denial Of Service Vulnerability".

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - .NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack
    against a .NET Core web application by improperly parsing certificate data. A denial of service
    vulnerability exists when .NET Core improperly handles parsing certificate data, aka ".NET CORE Denial Of
    Service Vulnerability". (CVE-2017-11770)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3248 advisory.

    New versions of .NET Core that address several security vulnerabilities are now available. The updated     versions are .NET Core 1.0.8, 1.1.5 and 2.0.3.

    Security Fix(es):

    * By providing an invalid culture, an attacker can cause a recursive lookup that leads to a denial of     service when running on certain Windows platforms. (CVE-2017-8585)

    * Supplying a specially crafted certificate can cause an infinite X509Chain, resulting in a denial of     service. (CVE-2017-11770)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft .NET Core runtime installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by a flaw due to a malformed certificate or other ASN.1 formatted data could lead to a denial of service via an infinite loop.
(CVE-2017-11770)

ID	Name	Product	Family	Type	Severity
412139	SCA: security update for Microsoft.NETCore.App, System.Security.Cryptography.X509Certificates (GHSA-7mfr-774f-w5r9)	Tenable Cloud Security	SCA Checks	Local	high
412139	SCA: security update for Microsoft.NETCore.App, System.Security.Cryptography.X509Certificates (GHSA-7mfr-774f-w5r9)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
104774	RHEL 7 : .NET Core (RHSA-2017:3248)	Nessus	Red Hat Local Security Checks	Local	high
104664	Security Update for .NET Core (November 2017) (macOS)	Nessus	MacOS X Local Security Checks	Local	high

Detections

Analytics

CVE-2017-11770

high

Tenable Plugins

high

high

high

high