Security Issues Hit .NET Core, Visual Studio

A recent Microsoft security update addresses a .NET Core security feature bypass vulnerability.

Microsoft on Tuesday announced several .NET Core security update downloads and updated several Docker images to address the vulnerability (the company always releases security updates on the second Tuesday of the month, commonly called Patch Tuesday).

Officially called CVE-2018-8356, the feature bypass vulnerability "exists when .NET Core does not correctly validate certificates. An attacker who successfully exploited this vulnerability could present an expired certificate when challenged," Microsoft said. The update corrects how .NET Core applications handle certificate validation.

Microsoft also issued security updates for several versions of Visual Studio and Expression Blend to address a remote code execution vulnerability dubbed CVE-2018-8172, though the company said it wasn't publicly disclosed or exploited, with exploitation "less likely" for both the latest and older software releases.

Here's Microsoft's description of the issue:

A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an unbuilt project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Visual Studio. In an email attack scenario, an attacker could exploit the vulnerability by sending a specially crafted project, or resource file, to the user and convince the user to open the file.

The security update addresses the vulnerability by correcting how Visual Studio checks the source markup of a file.

Further down the company's Exploitability Assessment ladder (judged "exploitation unlikely") was an ASP.NET security feature bypass vulnerability, officially named CVE-2018-8171, existing "in ASP.NET when the number of incorrect login attempts is not validated."

About the Author

David Ramel is an editor and writer for Converge360.

comments powered by Disqus


  • Entity Framework Core 6: What Developers Want

    Microsoft outlined its plan for Entity Framework Core 6, which in November will take its place as the data access component of the landmark .NET 6, a long-term support (LTS) release that will mark Microsoft's transition from the Windows-only .NET Framework to an open source, cross-platform umbrella offering of all things .NET.

  • AWS Open Sources .NET Porting Assistant GUI

    After previously open sourcing components of its Porting Assistant for .NET, Amazon Web Services open sourced the tool's GUI.

  • .NET Core Ranks High Among Frameworks in New Dev Survey

    .NET Core placed high in a web-dominated ranking of development frameworks published by CodinGame, which provides a tech hiring platform.

  • Here's a One-Stop Shop for .NET 5 Improvements

    Culled from reams of Microsoft documentation, here's a high-level summary of what's new for performance, networking, diagnostics and more, along with links to the nitty-gritty details for those wanting to dig in more.

Upcoming Events