Microsoft QUIC Denial of Service Vulnerability

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0680 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-36435:
    Microsoft QUIC Denial of Service Vulnerability

    CVE-2023-38171:
    Microsoft QUIC Denial of Service Vulnerability

    CVE-2023-44487:
    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023.

    CVE-2023-36792:
    Visual Studio Remote Code Execution Vulnerability

    CVE-2023-36793:
    Visual Studio Remote Code Execution Vulnerability

    CVE-2023-36794:
    Visual Studio Remote Code Execution Vulnerability

    CVE-2023-36796:
    Visual Studio Remote Code Execution Vulnerability

    CVE-2023-36799:
    .NET Core and Visual Studio Denial of Service Vulnerability

    CVE-2023-38180:
    .NET and Visual Studio Denial of Service Vulnerability

    CVE-2023-35391:
    ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

    CVE-2023-38178:
    .NET Core and Visual Studio Denial of Service Vulnerability

    CVE-2023-35390:
    .NET and Visual Studio Remote Code Execution Vulnerability

    CVE-2023-33170:
    ASP.NET and Visual Studio Security Feature Bypass Vulnerability

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Microsoft QUIC Denial of Service Vulnerability (CVE-2023-38171)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation
    can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

  - Microsoft QUIC Denial of Service Vulnerability (CVE-2023-36435)

  - Visual Studio Remote Code Execution Vulnerability (CVE-2023-36792, CVE-2023-36793, CVE-2023-36794)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Microsoft QUIC Denial of Service Vulnerability (CVE-2023-36435, CVE-2023-38171)

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation
    can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

The version of Microsoft .NET 7 Core installed on the remote host is prior to 7.0.12. It is, therefore, affected by multiple vulnerabilities as referenced in the 2023_Oct_10 advisory.

  - A vulnerability exists in the ASP.NET Core Kestrel web server where a malicious client may flood the   server with specially crafted HTTP/2 requests, causing denial of service. (CVE-2023-44487)

  - A null pointer vulnerability exists in MsQuic.dll which may lead to Denial of Service. This issue only   affects Windows systems. (CVE-2023-38171)

  - A memory leak vulnerability exists in MsQuic.dll which may lead to Denial of Service. This issue only   affects Windows systems. (CVE-2023-36435)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security   updates. It is, therefore, affected by multiple denial of   service vulnerabilities:
    - A denial of service (DoS) vulnerability. An attacker can       exploit this issue to cause the affected component to       deny system or application services. (CVE-2023-38171)

    - The HTTP/2 protocol allows a denial of service (server       resource consumption) because request cancellation can       reset many streams quickly (CVE-2023-44487)

The version of Microsoft .NET Core SDK installed on the remote host is 6.0.x prior to 6.0.123, 6.0.x prior to 6.0.318, 6.0.x prior to 6.0.414, 7.0.x prior to 7.0.112 or 7.0.x prior to 7.0.309 or 7.0.x prior to 7.0.402.
It is, therefore, affected by multiple vulnerabilities, as follows:

  - A vulnerability exists in the ASP.NET Core Kestrel web server where a malicious client may flood the   server with specially crafted HTTP/2 requests, causing denial of service. (CVE-2023-44487)   
  - A null pointer vulnerability exists in MsQuic.dll which may lead to Denial of Service. This issue only   affects Windows systems. (CVE-2023-38171)

  - A memory leak vulnerability exists in MsQuic.dll which may lead to Denial of Service. This issue only   affects Windows systems. (CVE-2023-36435)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5031358. It is, therefore, affected by multiple vulnerabilities

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

  - Microsoft QUIC Denial of Service Vulnerability (CVE-2023-36435, CVE-2023-38171)   
  - Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVE-2023-36577)

  - Windows IIS Server Elevation of Privilege Vulnerability (CVE-2023-36434)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5031354. It is, therefore, affected by multiple vulnerabilities

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

  - Microsoft QUIC Denial of Service Vulnerability (CVE-2023-36435, CVE-2023-38171)   
  - Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVE-2023-36577)

  - Windows IIS Server Elevation of Privilege Vulnerability (CVE-2023-36434)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5031364. It is, therefore, affected by multiple vulnerabilities

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

  - Microsoft QUIC Denial of Service Vulnerability (CVE-2023-36435, CVE-2023-38171)   
  - Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVE-2023-36577)

  - Windows IIS Server Elevation of Privilege Vulnerability (CVE-2023-36434)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
239454	TencentOS Server 4: dotnet7.0 (TSSA-2024:0680)	Nessus	Tencent Local Security Checks	medium
420513	SCA: security update for Microsoft.Native.Quic.MsQuic.OpenSSL, Microsoft.Native.Quic.MsQuic.Schannel (GHSA-xh5m-8qqp-c5x7)	Tenable Cloud Security	SCA Checks	high
420513	SCA: security update for Microsoft.Native.Quic.MsQuic.OpenSSL, Microsoft.Native.Quic.MsQuic.Schannel (GHSA-xh5m-8qqp-c5x7)	Tenable Self-Hosted Container Security	SCA Checks	high
404156	Alpine: dotnet7-runtime: security update to 7.0.13-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404156	Alpine: dotnet7-runtime: security update to 7.0.13-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
404155	Alpine: dotnet7-runtime: security update to 7.0.12-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404155	Alpine: dotnet7-runtime: security update to 7.0.12-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
404151	Alpine: dotnet7-build: security update to 7.0.113-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404151	Alpine: dotnet7-build: security update to 7.0.113-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
404150	Alpine: dotnet7-build: security update to 7.0.112-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404150	Alpine: dotnet7-build: security update to 7.0.112-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
183024	Security Update for Microsoft .NET 7 Core (October 2023)	Nessus	Windows	high
183020	Security Updates for Microsoft Visual Studio Products (October 2023)	Nessus	Windows : Microsoft Bulletins	high
182917	Security Update for .NET Core SDK (October 2023)	Nessus	Windows	high
182858	KB5031358: Windows 11 version 21H2 Security Update (October 2023)	Nessus	Windows : Microsoft Bulletins	critical
182855	KB5031354: Windows 11 version 22H2 Security Update (October 2023)	Nessus	Windows : Microsoft Bulletins	critical
182851	KB5031364: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (October 2023)	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2023-38171

high

Tenable Plugins

medium

high

high

critical

critical

critical

critical

critical

critical

critical

critical

high

high

high

critical

critical

critical