.NET Core and Visual Studio Denial of Service Vulnerability

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0680 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-36435:
    Microsoft QUIC Denial of Service Vulnerability

    CVE-2023-38171:
    Microsoft QUIC Denial of Service Vulnerability

    CVE-2023-44487:
    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023.

    CVE-2023-36792:
    Visual Studio Remote Code Execution Vulnerability

    CVE-2023-36793:
    Visual Studio Remote Code Execution Vulnerability

    CVE-2023-36794:
    Visual Studio Remote Code Execution Vulnerability

    CVE-2023-36796:
    Visual Studio Remote Code Execution Vulnerability

    CVE-2023-36799:
    .NET Core and Visual Studio Denial of Service Vulnerability

    CVE-2023-38180:
    .NET and Visual Studio Denial of Service Vulnerability

    CVE-2023-35391:
    ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

    CVE-2023-38178:
    .NET Core and Visual Studio Denial of Service Vulnerability

    CVE-2023-35390:
    .NET and Visual Studio Remote Code Execution Vulnerability

    CVE-2023-33170:
    ASP.NET and Visual Studio Security Feature Bypass Vulnerability

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the dotnet package has been released.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - .NET Core and Visual Studio Denial of Service Vulnerability (CVE-2023-38178)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2023-35390)

  - ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability (CVE-2023-35391)

  - .NET Core and Visual Studio Denial of Service Vulnerability (CVE-2023-38178)

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2023-38180)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-326 advisory.

    .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2023-35390)

    .NET Core and Visual Studio Denial of Service Vulnerability (CVE-2023-38178)

    .NET and Visual Studio Denial of Service Vulnerability (CVE-2023-38180)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Microsoft .NET Core SDK installed on the remote host is prior to 7.0.10. It is, therefore, affected by a denial-of-service (DoS) vulnerability. The vulnerability exists in .NET Kestrel where a malicious client can bypass QUIC stream limit in HTTP/3 in both ASP.NET and .NET runtimes resulting in denial of service.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6278-2 advisory.

    USN-6278-1 fixed several vulnerabilities in .NET. This update provides the corresponding updates for     Ubuntu 22.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - .NET Core and Visual Studio Denial of Service Vulnerability. (CVE-2023-38178)

  - .NET and Visual Studio Remote Code Execution Vulnerability. (CVE-2023-35390)

  - .NET and Visual Studio Denial of Service Vulnerability. (CVE-2023-38180)

  - ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability. (CVE-2023-35391)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6278-1 advisory.

    It was discovered that .NET did not properly handle the execution of certain commands. An attacker could     possibly use this issue to achieve remote code execution. (CVE-2023-35390)

    Benoit Foucher discovered that .NET did not properly implement the QUIC stream limit in HTTP/3. An     attacker could possibly use this issue to cause a denial of service. (CVE-2023-38178)

    It was discovered that .NET did not properly handle the disconnection of potentially malicious clients     interfacing with a Kestrel server. An attacker could possibly use this issue to cause a denial of service.
    (CVE-2023-38180)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2023_Aug_08 advisory.

  - .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2023-35390)

  - ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability (CVE-2023-35391)

  - .NET Core and Visual Studio Denial of Service Vulnerability (CVE-2023-38178)

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2023-38180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
239454	TencentOS Server 4: dotnet7.0 (TSSA-2024:0680)	Nessus	Tencent Local Security Checks	medium
234310	Photon OS 5.0: Dotnet PHSA-2025-5.0-0499	Nessus	PhotonOS Local Security Checks	critical
417297	SCA: security update for Microsoft.AspNetCore.App.Runtime.win-arm, Microsoft.AspNetCore.App.Runtime.win-arm64, Microsoft.AspNetCore.App.Runtime.win-x64, Microsoft.AspNetCore.App.Runtime.win-x86, Microsoft.NetCore.App.Runtime.win-arm, Microsoft.NetCore.App.Runtime.win-arm64, Microsoft.NetCore.App.Runtime.win-x64, Microsoft.NetCore.App.Runtime.win-x86 (GHSA-p57v-gv7q-4xfm)	Tenable Cloud Security	SCA Checks	high
417297	SCA: security update for Microsoft.AspNetCore.App.Runtime.win-arm, Microsoft.AspNetCore.App.Runtime.win-arm64, Microsoft.AspNetCore.App.Runtime.win-x64, Microsoft.AspNetCore.App.Runtime.win-x86, Microsoft.NetCore.App.Runtime.win-arm, Microsoft.NetCore.App.Runtime.win-arm64, Microsoft.NetCore.App.Runtime.win-x64, Microsoft.NetCore.App.Runtime.win-x86 (GHSA-p57v-gv7q-4xfm)	Tenable Self-Hosted Container Security	SCA Checks	high
404153	Alpine: dotnet7-runtime: security update to 7.0.10-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404153	Alpine: dotnet7-runtime: security update to 7.0.10-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404148	Alpine: dotnet7-build: security update to 7.0.110-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404148	Alpine: dotnet7-build: security update to 7.0.110-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
181148	Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2023-326)	Nessus	Amazon Linux Local Security Checks	high
180501	Security Update for .NET 7.0 Core SDK (CVE-2023-38178)	Nessus	Windows	high
179691	Ubuntu 22.04 LTS : .NET vulnerabilities (USN-6278-2)	Nessus	Ubuntu Local Security Checks	high
179645	Security Updates for Microsoft Visual Studio Products (August 2023)	Nessus	Windows : Microsoft Bulletins	high
179584	Ubuntu 23.04 : .NET vulnerabilities (USN-6278-1)	Nessus	Ubuntu Local Security Checks	high
179502	Security Update for Microsoft .NET Core (August 2023)	Nessus	Windows	high

Detections

Analytics

CVE-2023-38178

high

Tenable Plugins

medium

critical

high

high

high

high

high

high

high

high

high

high

high

high