A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka .NET Core     Tampering Vulnerability. This affects .NET Core 2.1. (CVE-2018-8416)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the dotnet package has been released.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core
    Tampering Vulnerability." This affects .NET Core 2.1. (CVE-2018-8416)

The remote Windows host has an installation of .NET Core with a version 2.1.x < 2.1.7 or 2.2.x < 2.2.1. It is, therefore, affected by the following vulnerabilities:

  - An information disclosure vulnerability exists in .NET Core.
  An unauthenticated, remote attacker can exploit this to bypass   cross-origin resource sharing (CORS), to disclose potentially   sensitive information. (CVE-2019-0545)

  - A tampering vulnerability exists in .NET Core. An   authenticated, remote attacker can exploit this to write arbitrary   files and directories with limited control of their destinations.
  (CVE-2018-8416)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:3676 advisory.

    .NET Core is a managed software framework. It implements a subset of the .NET framework APIs and several     new APIs, and it includes a CLR implementation.

    A new version of .NET Core that addresses a security vulnerability is now available. The updated version     is .NET Core 2.1.5.

    Security Fix(es):

    * .NET Core: Arbitrary file and directory creation (CVE-2018-8416)

    For more information, please refer to the upstream docs in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Windows host has an installation of .NET Core with a version of 2.1.x. Therefore, the host is affected by a tampering vulnerability which exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain limited locations on a vulnerable system.

ID	Name	Product	Family	Type	Severity
251399	Linux Distros Unpatched Vulnerability : CVE-2018-8416	Nessus	Misc.	Local	medium
237067	Photon OS 4.0: Dotnet PHSA-2025-4.0-0804	Nessus	PhotonOS Local Security Checks	Local	high
410611	SCA: security update for Microsoft.NETCore.App (GHSA-5633-f33j-c6f7)	Tenable Cloud Security	SCA Checks	Local	medium
410611	SCA: security update for Microsoft.NETCore.App (GHSA-5633-f33j-c6f7)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
123132	Security Update for .NET Core (January 2019)	Nessus	Windows	Local	high
119413	RHEL 7 : .NET Core on Red Hat Enterprise Linux (RHSA-2018:3676)	Nessus	Red Hat Local Security Checks	Local	medium
118979	Security Update for .NET Core (November 2018)	Nessus	Windows	Local	medium

Detections

Analytics

CVE-2018-8416

medium

Tenable Plugins

medium

high

medium

medium

high

medium

medium