.NET and Visual Studio Remote Code Execution Vulnerability

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:0830 advisory.

  - A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the     input length of a one-shot decompression request to a script can trigger a crash, which happens when     copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or     later. If one cannot update, we recommend to use the streaming API as opposed to the one-shot API, and     impose chunk size limits. (CVE-2020-8927)

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2022-24464)

  - .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2022-24512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:0826 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2022-24464)

  - .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2022-24512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:0827 advisory.

  - A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the     input length of a one-shot decompression request to a script can trigger a crash, which happens when     copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or     later. If one cannot update, we recommend to use the streaming API as opposed to the one-shot API, and     impose chunk size limits. (CVE-2020-8927)

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2022-24464)

  - .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2022-24512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0829 advisory.

  - brotli: buffer overflow when input chunk is larger than 2GiB (CVE-2020-8927)

  - dotnet: ASP.NET Denial of Service via FormPipeReader (CVE-2022-24464)

  - dotnet: double parser stack buffer overrun (CVE-2022-24512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-0827 advisory.

  - A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the     input length of a one-shot decompression request to a script can trigger a crash, which happens when     copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or     later. If one cannot update, we recommend to use the streaming API as opposed to the one-shot API, and     impose chunk size limits. (CVE-2020-8927)

  - .NET and Visual Studio Denial of Service Vulnerability. (CVE-2022-24464)

  - .NET and Visual Studio Remote Code Execution Vulnerability. (CVE-2022-24512)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-0826 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability. (CVE-2022-24464)

  - .NET and Visual Studio Remote Code Execution Vulnerability. (CVE-2022-24512)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-0830 advisory.

  - A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the     input length of a one-shot decompression request to a script can trigger a crash, which happens when     copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or     later. If one cannot update, we recommend to use the streaming API as opposed to the one-shot API, and     impose chunk size limits. (CVE-2020-8927)

  - .NET and Visual Studio Denial of Service Vulnerability. (CVE-2022-24464)

  - .NET and Visual Studio Remote Code Execution Vulnerability. (CVE-2022-24512)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:830 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability. (CVE-2022-24464)

  - .NET and Visual Studio Remote Code Execution Vulnerability. (CVE-2022-24512)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:827 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability. (CVE-2022-24464)

  - .NET and Visual Studio Remote Code Execution Vulnerability. (CVE-2022-24512)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:826 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability. (CVE-2022-24464)

  - .NET and Visual Studio Remote Code Execution Vulnerability. (CVE-2022-24512)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0830 advisory.

  - brotli: buffer overflow when input chunk is larger than 2GiB (CVE-2020-8927)

  - dotnet: ASP.NET Denial of Service via FormPipeReader (CVE-2022-24464)

  - dotnet: double parser stack buffer overrun (CVE-2022-24512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0832 advisory.

  - dotnet: ASP.NET Denial of Service via FormPipeReader (CVE-2022-24464)

  - dotnet: double parser stack buffer overrun (CVE-2022-24512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0827 advisory.

  - brotli: buffer overflow when input chunk is larger than 2GiB (CVE-2020-8927)

  - dotnet: ASP.NET Denial of Service via FormPipeReader (CVE-2022-24464)

  - dotnet: double parser stack buffer overrun (CVE-2022-24512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0828 advisory.

  - brotli: buffer overflow when input chunk is larger than 2GiB (CVE-2020-8927)

  - dotnet: ASP.NET Denial of Service via FormPipeReader (CVE-2022-24464)

  - dotnet: double parser stack buffer overrun (CVE-2022-24512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0826 advisory.

  - dotnet: ASP.NET Denial of Service via FormPipeReader (CVE-2022-24464)

  - dotnet: double parser stack buffer overrun (CVE-2022-24512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft .NET core installations on the remote host are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected     component to deny system or application services. (CVE-2022-24464)

  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2020-8927, CVE-2022-24512)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2022-24464)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2020-8927,     CVE-2022-24512)

    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version     number.

ID	Name	Product	Family	Severity
184963	Rocky Linux 8 : .NET 5.0 (RLSA-2022:0830)	Nessus	Rocky Linux Local Security Checks	medium
184736	Rocky Linux 8 : .NET 6.0 (RLSA-2022:0826)	Nessus	Rocky Linux Local Security Checks	medium
184566	Rocky Linux 8 : .NET Core 3.1 (RLSA-2022:0827)	Nessus	Rocky Linux Local Security Checks	medium
158895	RHEL 7 : .NET Core 3.1 on RHEL 7 (RHSA-2022:0829)	Nessus	Red Hat Local Security Checks	medium
158884	Oracle Linux 8 : .NET / Core / 3.1 (ELSA-2022-0827)	Nessus	Oracle Linux Local Security Checks	medium
158882	Oracle Linux 8 : .NET / 6.0 (ELSA-2022-0826)	Nessus	Oracle Linux Local Security Checks	medium
158881	Oracle Linux 8 : .NET / 5.0 (ELSA-2022-0830)	Nessus	Oracle Linux Local Security Checks	medium
158876	Rocky Linux 8 : .NET 5.0 (RLSA-2022:830)	Nessus	Rocky Linux Local Security Checks	medium
158868	Rocky Linux 8 : .NET Core 3.1 (RLSA-2022:827)	Nessus	Rocky Linux Local Security Checks	medium
158867	Rocky Linux 8 : .NET 6.0 (RLSA-2022:826)	Nessus	Rocky Linux Local Security Checks	medium
158816	RHEL 8 : .NET 5.0 (RHSA-2022:0830)	Nessus	Red Hat Local Security Checks	medium
158815	RHEL 7 : .NET 6.0 on RHEL 7 (RHSA-2022:0832)	Nessus	Red Hat Local Security Checks	medium
158810	RHEL 8 : .NET Core 3.1 (RHSA-2022:0827)	Nessus	Red Hat Local Security Checks	medium
158806	RHEL 7 : .NET 5.0 on RHEL 7 (RHSA-2022:0828)	Nessus	Red Hat Local Security Checks	medium
158802	RHEL 8 : .NET 6.0 (RHSA-2022:0826)	Nessus	Red Hat Local Security Checks	medium
158744	Security Updates for Microsoft .NET core (March 2022)	Nessus	Misc.	medium
158715	Security Updates for Microsoft Visual Studio Products (March 2022)	Nessus	Windows : Microsoft Bulletins	medium

Detections

Analytics

CVE-2022-24512

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium