Sign-up

ID

VAR-202402-1535


CVE

CVE-2024-21386


TITLE

Microsoft's  Microsoft Visual Studio  and  ASP.NET Core  Service operation interruption in  (DoS)  Vulnerability Stated

Trust: 0.8

sources: JVNDB: JVNDB-2024-002866

DESCRIPTION

.NET Denial of Service Vulnerability. Microsoft's Microsoft Visual Studio and ASP.NET Core for, .NET Service operation is interrupted due to a defect in (DoS) A state vulnerability exists.Service operation interruption (DoS) It may be in a state. The following advisory data is extracted from: https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_0814.json Red Hat officially shut down their mailing list notifications October 10, 2023. Due to this, Packet Storm has recreated the below data as a reference point to raise awareness. It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment. - Packet Storm Staff ==================================================================== Red Hat Security Advisory Synopsis: Important: .NET 6.0 security, bug fix, and enhancement update Advisory ID: RHSA-2024:0814-03 Product: .NET Core on Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2024:0814 Issue date: 2024-02-14 Revision: 03 CVE Names: CVE-2024-21386 ==================================================================== Summary: An update for .NET 6.0 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description: .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.127 and .NET Runtime 6.0.27. The following packages have been upgraded to a later upstream version: rh-dotnet60-dotnet (6.0.127). (BZ#2262321) Security Fix(es): * dotnet: Denial of Service in SignalR server (CVE-2024-21386) * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution: https://access.redhat.com/articles/11258 CVEs: CVE-2024-21386 References: https://access.redhat.com/security/updates/classification/#important https://bugzilla.redhat.com/show_bug.cgi?id=2263085 https://bugzilla.redhat.com/show_bug.cgi?id=2263086 . ========================================================================== Ubuntu Security Notice USN-6634-1 February 13, 2024 dotnet6, dotnet7, dotnet8 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.10 - Ubuntu 22.04 LTS Summary: Several security issues were fixed in .NET. Software Description: - dotnet6: dotNET CLI tools and runtime - dotnet7: dotNET CLI tools and runtime - dotnet8: dotNET CLI tools and runtime Details: Brennan Conroy discovered that .NET with SignalR did not properly handle malicious clients. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-21386) Bahaa Naamneh discovered that .NET with OpenSSL support did not properly parse X509 certificates. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-21404) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.10: aspnetcore-runtime-6.0 6.0.127-0ubuntu1~23.10.1 aspnetcore-runtime-7.0 7.0.116-0ubuntu1~23.10.1 aspnetcore-runtime-8.0 8.0.2-0ubuntu1~23.10.1 dotnet-host 6.0.127-0ubuntu1~23.10.1 dotnet-host-7.0 7.0.116-0ubuntu1~23.10.1 dotnet-host-8.0 8.0.2-0ubuntu1~23.10.1 dotnet-hostfxr-6.0 6.0.127-0ubuntu1~23.10.1 dotnet-hostfxr-7.0 7.0.116-0ubuntu1~23.10.1 dotnet-hostfxr-8.0 8.0.2-0ubuntu1~23.10.1 dotnet-runtime-6.0 6.0.127-0ubuntu1~23.10.1 dotnet-runtime-7.0 7.0.116-0ubuntu1~23.10.1 dotnet-runtime-8.0 8.0.2-0ubuntu1~23.10.1 dotnet-sdk-6.0 6.0.127-0ubuntu1~23.10.1 dotnet-sdk-7.0 7.0.116-0ubuntu1~23.10.1 dotnet-sdk-8.0 8.0.102-0ubuntu1~23.10.1 dotnet6 6.0.127-0ubuntu1~23.10.1 dotnet7 7.0.116-0ubuntu1~23.10.1 dotnet8 8.0.102-8.0.2-0ubuntu1~23.10.1 Ubuntu 22.04 LTS: aspnetcore-runtime-6.0 6.0.127-0ubuntu1~22.04.1 aspnetcore-runtime-7.0 7.0.116-0ubuntu1~22.04.1 aspnetcore-runtime-8.0 8.0.2-0ubuntu1~22.04.1 dotnet-host 6.0.127-0ubuntu1~22.04.1 dotnet-host-7.0 7.0.116-0ubuntu1~22.04.1 dotnet-host-8.0 8.0.2-0ubuntu1~22.04.1 dotnet-hostfxr-6.0 6.0.127-0ubuntu1~22.04.1 dotnet-hostfxr-7.0 7.0.116-0ubuntu1~22.04.1 dotnet-hostfxr-8.0 8.0.2-0ubuntu1~22.04.1 dotnet-runtime-6.0 6.0.127-0ubuntu1~22.04.1 dotnet-runtime-7.0 7.0.116-0ubuntu1~22.04.1 dotnet-runtime-8.0 8.0.2-0ubuntu1~22.04.1 dotnet-sdk-6.0 6.0.127-0ubuntu1~22.04.1 dotnet-sdk-7.0 7.0.116-0ubuntu1~22.04.1 dotnet-sdk-8.0 8.0.102-0ubuntu1~22.04.1 dotnet6 6.0.127-0ubuntu1~22.04.1 dotnet7 7.0.116-0ubuntu1~22.04.1 dotnet8 8.0.102-8.0.2-0ubuntu1~22.04.1 In general, a standard system update will make all the necessary changes

Trust: 2.43

sources: NVD: CVE-2024-21386 // JVNDB: JVNDB-2024-002866 // VULMON: CVE-2024-21386 // PACKETSTORM: 177137 // PACKETSTORM: 177124 // PACKETSTORM: 177122 // PACKETSTORM: 177121 // PACKETSTORM: 177120 // PACKETSTORM: 177119 // PACKETSTORM: 177110 // PACKETSTORM: 177155

AFFECTED PRODUCTS

vendor:microsoftmodel:asp.net corescope:gteversion:6.0.0

Trust: 1.0

vendor:microsoftmodel:asp.net corescope:ltversion:7.0.16

Trust: 1.0

vendor:microsoftmodel:visual studio 2022scope:ltversion:17.4.16

Trust: 1.0

vendor:microsoftmodel:asp.net corescope:ltversion:6.0.27

Trust: 1.0

vendor:microsoftmodel:asp.net corescope:gteversion:7.0.0

Trust: 1.0

vendor:microsoftmodel:asp.net corescope:ltversion:8.0.2

Trust: 1.0

vendor:microsoftmodel:visual studio 2022scope:gteversion:17.6.0

Trust: 1.0

vendor:microsoftmodel:visual studio 2022scope:gteversion:17.8.0

Trust: 1.0

vendor:microsoftmodel:visual studio 2022scope:ltversion:17.6.12

Trust: 1.0

vendor:microsoftmodel:visual studio 2022scope:ltversion:17.8.7

Trust: 1.0

vendor:microsoftmodel:asp.net corescope:gteversion:8.0.0

Trust: 1.0

vendor:microsoftmodel:visual studio 2022scope:gteversion:17.4.0

Trust: 1.0

vendor:マイクロソフトmodel:microsoft visual studioscope:eqversion:2022 17.4

Trust: 0.8

vendor:マイクロソフトmodel:microsoft visual studioscope:eqversion:2022 17.8

Trust: 0.8

vendor:マイクロソフトmodel:microsoft visual studioscope:eqversion:2022 17.6

Trust: 0.8

vendor:マイクロソフトmodel:asp.net corescope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2024-002866 // NVD: CVE-2024-21386

CVSS

SEVERITY

CVSSV2

CVSSV3

secure@microsoft.com: CVE-2024-21386
value: HIGH

Trust: 1.0

OTHER: JVNDB-2024-002866
value: HIGH

Trust: 0.8

secure@microsoft.com: CVE-2024-21386
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

OTHER: JVNDB-2024-002866
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2024-002866 // NVD: CVE-2024-21386

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-400

Trust: 1.0

problemtype:Lack of information (CWE-noinfo) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2024-002866 // NVD: CVE-2024-21386

PATCH

title:.NET Denial of Service Vulnerability Security Update Guideurl:https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21386

Trust: 0.8

title:Red Hat: url:https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2024-21386

Trust: 0.1

sources: VULMON: CVE-2024-21386 // JVNDB: JVNDB-2024-002866

EXTERNAL IDS

db:NVDid:CVE-2024-21386

Trust: 3.5

db:JVNDBid:JVNDB-2024-002866

Trust: 0.8

db:VULMONid:CVE-2024-21386

Trust: 0.1

db:PACKETSTORMid:177137

Trust: 0.1

db:PACKETSTORMid:177124

Trust: 0.1

db:PACKETSTORMid:177122

Trust: 0.1

db:PACKETSTORMid:177121

Trust: 0.1

db:PACKETSTORMid:177120

Trust: 0.1

db:PACKETSTORMid:177119

Trust: 0.1

db:PACKETSTORMid:177110

Trust: 0.1

db:PACKETSTORMid:177155

Trust: 0.1

sources: VULMON: CVE-2024-21386 // JVNDB: JVNDB-2024-002866 // PACKETSTORM: 177137 // PACKETSTORM: 177124 // PACKETSTORM: 177122 // PACKETSTORM: 177121 // PACKETSTORM: 177120 // PACKETSTORM: 177119 // PACKETSTORM: 177110 // PACKETSTORM: 177155 // NVD: CVE-2024-21386

REFERENCES

url:https://nvd.nist.gov/vuln/detail/cve-2024-21386

Trust: 1.6

url:https://msrc.microsoft.com/update-guide/vulnerability/cve-2024-21386

Trust: 1.1

url:https://www.ipa.go.jp/security/security-alert/2023/0214-ms.html

Trust: 0.8

url:https://www.jpcert.or.jp/at/2024/at240006.html

Trust: 0.8

url:https://access.redhat.com/articles/11258

Trust: 0.7

url:https://bugzilla.redhat.com/show_bug.cgi?id=2263086

Trust: 0.7

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.7

url:https://bugzilla.redhat.com/show_bug.cgi?id=2263085

Trust: 0.7

url:https://nvd.nist.gov

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2024-21386

Trust: 0.1

url:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_0827.json

Trust: 0.1

url:https://issues.redhat.com/browse/rhel-23939

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2024:0827

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2024:0814

Trust: 0.1

url:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_0814.json

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2024:0808

Trust: 0.1

url:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_0808.json

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2024:0807

Trust: 0.1

url:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_0807.json

Trust: 0.1

url:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_0806.json

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2024:0806

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2024:0805

Trust: 0.1

url:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_0805.json

Trust: 0.1

url:https://ubuntu.com/security/notices/usn-6634-1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/dotnet8/8.0.102-8.0.2-0ubuntu1~23.10.1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/dotnet7/7.0.116-0ubuntu1~23.10.1

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2024-21404

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/dotnet6/6.0.127-0ubuntu1~22.04.1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/dotnet8/8.0.102-8.0.2-0ubuntu1~22.04.1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/dotnet7/7.0.116-0ubuntu1~22.04.1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/dotnet6/6.0.127-0ubuntu1~23.10.1

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2024:0848

Trust: 0.1

url:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_0848.json

Trust: 0.1

url:https://issues.redhat.com/browse/rhel-23938

Trust: 0.1

sources: VULMON: CVE-2024-21386 // JVNDB: JVNDB-2024-002866 // PACKETSTORM: 177137 // PACKETSTORM: 177124 // PACKETSTORM: 177122 // PACKETSTORM: 177121 // PACKETSTORM: 177120 // PACKETSTORM: 177119 // PACKETSTORM: 177110 // PACKETSTORM: 177155 // NVD: CVE-2024-21386

CREDITS

Red Hat

Trust: 0.7

sources: PACKETSTORM: 177137 // PACKETSTORM: 177124 // PACKETSTORM: 177122 // PACKETSTORM: 177121 // PACKETSTORM: 177120 // PACKETSTORM: 177119 // PACKETSTORM: 177155

SOURCES

db:VULMONid:CVE-2024-21386
db:JVNDBid:JVNDB-2024-002866
db:PACKETSTORMid:177137
db:PACKETSTORMid:177124
db:PACKETSTORMid:177122
db:PACKETSTORMid:177121
db:PACKETSTORMid:177120
db:PACKETSTORMid:177119
db:PACKETSTORMid:177110
db:PACKETSTORMid:177155
db:NVDid:CVE-2024-21386

LAST UPDATE DATE

2024-08-14T14:09:34.001000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2024-21386date:2024-02-13T00:00:00
db:JVNDBid:JVNDB-2024-002866date:2024-02-28T01:18:00
db:NVDid:CVE-2024-21386date:2024-05-29T00:15:31.847

SOURCES RELEASE DATE

db:VULMONid:CVE-2024-21386date:2024-02-13T00:00:00
db:JVNDBid:JVNDB-2024-002866date:2024-02-28T00:00:00
db:PACKETSTORMid:177137date:2024-02-15T15:12:47
db:PACKETSTORMid:177124date:2024-02-14T15:09:06
db:PACKETSTORMid:177122date:2024-02-14T15:08:50
db:PACKETSTORMid:177121date:2024-02-14T15:08:43
db:PACKETSTORMid:177120date:2024-02-14T15:08:33
db:PACKETSTORMid:177119date:2024-02-14T15:08:24
db:PACKETSTORMid:177110date:2024-02-14T15:06:51
db:PACKETSTORMid:177155date:2024-02-16T14:54:59
db:NVDid:CVE-2024-21386date:2024-02-13T18:15:56.737