Sign-up

ID

VAR-202402-1534


CVE

CVE-2024-21404


TITLE

Microsoft's  .NET  and  Microsoft Visual Studio  Service operation interruption in  (DoS)  Vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2024-002845

DESCRIPTION

.NET Denial of Service Vulnerability. Microsoft's .NET and Microsoft Visual Studio includes denial of service (DoS) Vulnerability exists.Service operation interruption (DoS) It may be in a state. ========================================================================== Ubuntu Security Notice USN-6634-1 February 13, 2024 dotnet6, dotnet7, dotnet8 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.10 - Ubuntu 22.04 LTS Summary: Several security issues were fixed in .NET. Software Description: - dotnet6: dotNET CLI tools and runtime - dotnet7: dotNET CLI tools and runtime - dotnet8: dotNET CLI tools and runtime Details: Brennan Conroy discovered that .NET with SignalR did not properly handle malicious clients. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-21386) Bahaa Naamneh discovered that .NET with OpenSSL support did not properly parse X509 certificates. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-21404) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.10: aspnetcore-runtime-6.0 6.0.127-0ubuntu1~23.10.1 aspnetcore-runtime-7.0 7.0.116-0ubuntu1~23.10.1 aspnetcore-runtime-8.0 8.0.2-0ubuntu1~23.10.1 dotnet-host 6.0.127-0ubuntu1~23.10.1 dotnet-host-7.0 7.0.116-0ubuntu1~23.10.1 dotnet-host-8.0 8.0.2-0ubuntu1~23.10.1 dotnet-hostfxr-6.0 6.0.127-0ubuntu1~23.10.1 dotnet-hostfxr-7.0 7.0.116-0ubuntu1~23.10.1 dotnet-hostfxr-8.0 8.0.2-0ubuntu1~23.10.1 dotnet-runtime-6.0 6.0.127-0ubuntu1~23.10.1 dotnet-runtime-7.0 7.0.116-0ubuntu1~23.10.1 dotnet-runtime-8.0 8.0.2-0ubuntu1~23.10.1 dotnet-sdk-6.0 6.0.127-0ubuntu1~23.10.1 dotnet-sdk-7.0 7.0.116-0ubuntu1~23.10.1 dotnet-sdk-8.0 8.0.102-0ubuntu1~23.10.1 dotnet6 6.0.127-0ubuntu1~23.10.1 dotnet7 7.0.116-0ubuntu1~23.10.1 dotnet8 8.0.102-8.0.2-0ubuntu1~23.10.1 Ubuntu 22.04 LTS: aspnetcore-runtime-6.0 6.0.127-0ubuntu1~22.04.1 aspnetcore-runtime-7.0 7.0.116-0ubuntu1~22.04.1 aspnetcore-runtime-8.0 8.0.2-0ubuntu1~22.04.1 dotnet-host 6.0.127-0ubuntu1~22.04.1 dotnet-host-7.0 7.0.116-0ubuntu1~22.04.1 dotnet-host-8.0 8.0.2-0ubuntu1~22.04.1 dotnet-hostfxr-6.0 6.0.127-0ubuntu1~22.04.1 dotnet-hostfxr-7.0 7.0.116-0ubuntu1~22.04.1 dotnet-hostfxr-8.0 8.0.2-0ubuntu1~22.04.1 dotnet-runtime-6.0 6.0.127-0ubuntu1~22.04.1 dotnet-runtime-7.0 7.0.116-0ubuntu1~22.04.1 dotnet-runtime-8.0 8.0.2-0ubuntu1~22.04.1 dotnet-sdk-6.0 6.0.127-0ubuntu1~22.04.1 dotnet-sdk-7.0 7.0.116-0ubuntu1~22.04.1 dotnet-sdk-8.0 8.0.102-0ubuntu1~22.04.1 dotnet6 6.0.127-0ubuntu1~22.04.1 dotnet7 7.0.116-0ubuntu1~22.04.1 dotnet8 8.0.102-8.0.2-0ubuntu1~22.04.1 In general, a standard system update will make all the necessary changes. The following advisory data is extracted from: https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_1552.json Red Hat officially shut down their mailing list notifications October 10, 2023. Due to this, Packet Storm has recreated the below data as a reference point to raise awareness. It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment. - Packet Storm Staff ==================================================================== Red Hat Security Advisory Synopsis: Important: .NET 6.0 security update Advisory ID: RHSA-2024:1552-03 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2024:1552 Issue date: 2024-03-28 Revision: 03 CVE Names: CVE-2024-21404 ==================================================================== Summary: An update for .NET 6.0 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description: .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.127 and .NET Runtime 6.0.27. Security Fix(es): * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution: https://access.redhat.com/articles/11258 CVEs: CVE-2024-21404 References: https://access.redhat.com/security/updates/classification/#important https://bugzilla.redhat.com/show_bug.cgi?id=2263086

Trust: 2.34

sources: NVD: CVE-2024-21404 // JVNDB: JVNDB-2024-002845 // VULMON: CVE-2024-21404 // PACKETSTORM: 177110 // PACKETSTORM: 177926 // PACKETSTORM: 177925 // PACKETSTORM: 177834 // PACKETSTORM: 177833 // PACKETSTORM: 177831 // PACKETSTORM: 177830

AFFECTED PRODUCTS

vendor:microsoftmodel:asp.net corescope:gteversion:6.0.0

Trust: 1.0

vendor:microsoftmodel:asp.net corescope:ltversion:7.0.16

Trust: 1.0

vendor:microsoftmodel:visual studio 2022scope:ltversion:17.4.16

Trust: 1.0

vendor:microsoftmodel:asp.net corescope:ltversion:6.0.27

Trust: 1.0

vendor:microsoftmodel:asp.net corescope:gteversion:7.0.0

Trust: 1.0

vendor:microsoftmodel:asp.net corescope:ltversion:8.0.2

Trust: 1.0

vendor:microsoftmodel:visual studio 2022scope:gteversion:17.6.0

Trust: 1.0

vendor:microsoftmodel:visual studio 2022scope:gteversion:17.8.0

Trust: 1.0

vendor:microsoftmodel:visual studio 2022scope:ltversion:17.6.12

Trust: 1.0

vendor:microsoftmodel:visual studio 2022scope:ltversion:17.8.7

Trust: 1.0

vendor:microsoftmodel:asp.net corescope:gteversion:8.0.0

Trust: 1.0

vendor:microsoftmodel:visual studio 2022scope:gteversion:17.4.0

Trust: 1.0

vendor:マイクロソフトmodel:microsoft visual studioscope:eqversion:2022 17.6

Trust: 0.8

vendor:マイクロソフトmodel:.netscope: - version: -

Trust: 0.8

vendor:マイクロソフトmodel:microsoft visual studioscope:eqversion:2022 17.4

Trust: 0.8

vendor:マイクロソフトmodel:microsoft visual studioscope:eqversion:2022 17.8

Trust: 0.8

sources: JVNDB: JVNDB-2024-002845 // NVD: CVE-2024-21404

CVSS

SEVERITY

CVSSV2

CVSSV3

secure@microsoft.com: CVE-2024-21404
value: HIGH

Trust: 1.0

OTHER: JVNDB-2024-002845
value: HIGH

Trust: 0.8

secure@microsoft.com: CVE-2024-21404
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

OTHER: JVNDB-2024-002845
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2024-002845 // NVD: CVE-2024-21404

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-476

Trust: 1.0

problemtype:Lack of information (CWE-noinfo) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2024-002845 // NVD: CVE-2024-21404

PATCH

title:.NET Denial of Service Vulnerability Security Update Guideurl:https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21404

Trust: 0.8

title:Red Hat: url:https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2024-21404

Trust: 0.1

sources: VULMON: CVE-2024-21404 // JVNDB: JVNDB-2024-002845

EXTERNAL IDS

db:NVDid:CVE-2024-21404

Trust: 3.4

db:JVNDBid:JVNDB-2024-002845

Trust: 0.8

db:VULMONid:CVE-2024-21404

Trust: 0.1

db:PACKETSTORMid:177110

Trust: 0.1

db:PACKETSTORMid:177926

Trust: 0.1

db:PACKETSTORMid:177925

Trust: 0.1

db:PACKETSTORMid:177834

Trust: 0.1

db:PACKETSTORMid:177833

Trust: 0.1

db:PACKETSTORMid:177831

Trust: 0.1

db:PACKETSTORMid:177830

Trust: 0.1

sources: VULMON: CVE-2024-21404 // JVNDB: JVNDB-2024-002845 // PACKETSTORM: 177110 // PACKETSTORM: 177926 // PACKETSTORM: 177925 // PACKETSTORM: 177834 // PACKETSTORM: 177833 // PACKETSTORM: 177831 // PACKETSTORM: 177830 // NVD: CVE-2024-21404

REFERENCES

url:https://nvd.nist.gov/vuln/detail/cve-2024-21404

Trust: 1.5

url:https://msrc.microsoft.com/update-guide/vulnerability/cve-2024-21404

Trust: 1.1

url:https://www.ipa.go.jp/security/security-alert/2023/0214-ms.html

Trust: 0.8

url:https://www.jpcert.or.jp/at/2024/at240006.html

Trust: 0.8

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.6

url:https://access.redhat.com/articles/11258

Trust: 0.6

url:https://bugzilla.redhat.com/show_bug.cgi?id=2263086

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2024-21404

Trust: 0.1

url:https://ubuntu.com/security/notices/usn-6634-1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/dotnet8/8.0.102-8.0.2-0ubuntu1~23.10.1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/dotnet7/7.0.116-0ubuntu1~23.10.1

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2024-21386

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/dotnet6/6.0.127-0ubuntu1~22.04.1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/dotnet8/8.0.102-8.0.2-0ubuntu1~22.04.1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/dotnet7/7.0.116-0ubuntu1~22.04.1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/dotnet6/6.0.127-0ubuntu1~23.10.1

Trust: 0.1

url:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_1643.json

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2024:1643

Trust: 0.1

url:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_1641.json

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2024:1641

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2024:1555

Trust: 0.1

url:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_1555.json

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2024:1554

Trust: 0.1

url:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_1554.json

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2024:1553

Trust: 0.1

url:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_1553.json

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2024:1552

Trust: 0.1

url:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_1552.json

Trust: 0.1

sources: VULMON: CVE-2024-21404 // JVNDB: JVNDB-2024-002845 // PACKETSTORM: 177110 // PACKETSTORM: 177926 // PACKETSTORM: 177925 // PACKETSTORM: 177834 // PACKETSTORM: 177833 // PACKETSTORM: 177831 // PACKETSTORM: 177830 // NVD: CVE-2024-21404

CREDITS

Red Hat

Trust: 0.6

sources: PACKETSTORM: 177926 // PACKETSTORM: 177925 // PACKETSTORM: 177834 // PACKETSTORM: 177833 // PACKETSTORM: 177831 // PACKETSTORM: 177830

SOURCES

db:VULMONid:CVE-2024-21404
db:JVNDBid:JVNDB-2024-002845
db:PACKETSTORMid:177110
db:PACKETSTORMid:177926
db:PACKETSTORMid:177925
db:PACKETSTORMid:177834
db:PACKETSTORMid:177833
db:PACKETSTORMid:177831
db:PACKETSTORMid:177830
db:NVDid:CVE-2024-21404

LAST UPDATE DATE

2024-08-14T14:09:34.055000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2024-21404date:2024-02-13T00:00:00
db:JVNDBid:JVNDB-2024-002845date:2024-02-27T02:01:00
db:NVDid:CVE-2024-21404date:2024-05-29T00:15:33.610

SOURCES RELEASE DATE

db:VULMONid:CVE-2024-21404date:2024-02-13T00:00:00
db:JVNDBid:JVNDB-2024-002845date:2024-02-27T00:00:00
db:PACKETSTORMid:177110date:2024-02-14T15:06:51
db:PACKETSTORMid:177926date:2024-04-03T20:11:56
db:PACKETSTORMid:177925date:2024-04-03T19:59:49
db:PACKETSTORMid:177834date:2024-03-28T14:29:15
db:PACKETSTORMid:177833date:2024-03-28T14:29:07
db:PACKETSTORMid:177831date:2024-03-28T14:27:30
db:PACKETSTORMid:177830date:2024-03-28T14:27:23
db:NVDid:CVE-2024-21404date:2024-02-13T18:15:59.023