Microsoft QUIC Denial of Service Vulnerability

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2024-21392)

  - Microsoft QUIC Denial of Service Vulnerability (CVE-2024-26190)

An update of the powershell package has been released.

The version of .NET Core SDK installed on the remote host is 6.x prior to 6.0.27, 7.x prior to 7.0.16 or 8.x prior to 8.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the February 2024 advisory:

  - A vulnerability exists in .NET where specially crafted requests may cause a resource leak, leading to a     denial of service. (CVE-2024-21392)

  - A Vulnerability exist in MsQuic.dll which might result in a peer to allocate small chunks of memory as     long as connection stays alive. (CVE-2024-26190) 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5035857 or Azure HotPatch 5035959. It is, therefore, affected by multiple vulnerabilities

  - Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVE-2024-21441,     CVE-2024-21444, CVE-2024-21450, CVE-2024-26161, CVE-2024-26166)

  - Windows USB Hub Driver Remote Code Execution Vulnerability (CVE-2024-21429)

  - Windows USB Attached SCSI (UAS) Protocol Remote Code Execution Vulnerability (CVE-2024-21430)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5035853. It is, therefore, affected by multiple vulnerabilities

  - Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVE-2024-21441,     CVE-2024-21444, CVE-2024-21450, CVE-2024-26161, CVE-2024-26166)

  - Windows USB Hub Driver Remote Code Execution Vulnerability (CVE-2024-21429)

  - Windows USB Attached SCSI (UAS) Protocol Remote Code Execution Vulnerability (CVE-2024-21430)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5035856. It is, therefore, affected by multiple vulnerabilities

  - Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVE-2024-21441,     CVE-2024-21444, CVE-2024-21450, CVE-2024-26161, CVE-2024-26166)

  - Windows USB Hub Driver Remote Code Execution Vulnerability (CVE-2024-21429)

  - Windows USB Attached SCSI (UAS) Protocol Remote Code Execution Vulnerability (CVE-2024-21430)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple denial of service vulnerabilities. An attacker can exploit these issues to cause the affected component to deny system or application services.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5035854. It is, therefore, affected by multiple vulnerabilities

  - Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVE-2024-21441,     CVE-2024-21444, CVE-2024-21450, CVE-2024-26161, CVE-2024-26166)

  - Windows USB Hub Driver Remote Code Execution Vulnerability (CVE-2024-21429)

  - Windows USB Attached SCSI (UAS) Protocol Remote Code Execution Vulnerability (CVE-2024-21430)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
427357	Alpine: multiple aspnetcore8-runtime packages, multiple dotnet-host packages: security update to 8.0.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
427357	Alpine: multiple aspnetcore8-runtime packages, multiple dotnet-host packages: security update to 8.0.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
235793	Photon OS 5.0: Powershell PHSA-2024-5.0-0316	Nessus	PhotonOS Local Security Checks	high
408316	Alpine: dotnet7-runtime: security update to 7.0.17-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
408316	Alpine: dotnet7-runtime: security update to 7.0.17-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
408315	Alpine: dotnet7-build: security update to 7.0.117-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
408315	Alpine: dotnet7-build: security update to 7.0.117-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
192026	Security Update for Microsoft .NET Core SDK (March 2024)	Nessus	Windows	high
191947	KB5035857: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (March 2024)	Nessus	Windows : Microsoft Bulletins	high
191937	KB5035853: Windows 11 version 22H2 / Windows 11 version 23H2 Security Update (March 2024)	Nessus	Windows : Microsoft Bulletins	high
191936	KB5035856: Windows Server version 23H2 Security Update (March 2024)	Nessus	Windows : Microsoft Bulletins	high
191932	Security Updates for Microsoft Visual Studio Products (March 2024)	Nessus	Windows : Microsoft Bulletins	high
191930	KB5035854: Windows 11 version 21H2 Security Update (March 2024)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2024-26190

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high