Security Issues Hit .NET Core, Visual Studio

A recent Microsoft security update addresses a .NET Core security feature bypass vulnerability.

Microsoft on Tuesday announced several .NET Core security update downloads and updated several Docker images to address the vulnerability (the company always releases security updates on the second Tuesday of the month, commonly called Patch Tuesday).

Officially called CVE-2018-8356, the feature bypass vulnerability "exists when .NET Core does not correctly validate certificates. An attacker who successfully exploited this vulnerability could present an expired certificate when challenged," Microsoft said. The update corrects how .NET Core applications handle certificate validation.

Microsoft also issued security updates for several versions of Visual Studio and Expression Blend to address a remote code execution vulnerability dubbed CVE-2018-8172, though the company said it wasn't publicly disclosed or exploited, with exploitation "less likely" for both the latest and older software releases.

Here's Microsoft's description of the issue:

A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an unbuilt project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Visual Studio. In an email attack scenario, an attacker could exploit the vulnerability by sending a specially crafted project, or resource file, to the user and convince the user to open the file.

The security update addresses the vulnerability by correcting how Visual Studio checks the source markup of a file.

Further down the company's Exploitability Assessment ladder (judged "exploitation unlikely") was an ASP.NET security feature bypass vulnerability, officially named CVE-2018-8171, existing "in ASP.NET when the number of incorrect login attempts is not validated."

About the Author

David Ramel is an editor and writer for Converge360.

comments powered by Disqus


  • Telerik UI for Blazor Updated

    Progress announced an update to its Telerik UI for Blazor components, targeting Microsoft's open source Blazor framework that lets C# coders create web apps without having to rely upon JavaScript.

  • Infragistics Unveils UI Components for Blazor

    Infragistics, specializing in third-party UI/UX controls and tools, unveiled a new offering targeting Blazor, Microsoft's red-hot open source framework that allows for C#-based web development instead of traditional mainstay JavaScript.

  • AWS Open Sources Tool for Porting .NET Framework Apps to .NET Core

    Leading cloud computing platform Amazon Web Services open sourced the it announced in July for helping users port old .NET Framework applications to the new .NET Core framework.

  • Uno Platform Ports Windows Calculator to Linux

    Uno Platform has ported the famed Windows Calculator, open sourced last year, to Linux as part of a continuing "proof point" effort to demonstrate the reach of what it describes as the sole UI offering available to target Windows, WebAssembly, iOS, macOS, Android and Linux with single-codebase applications coded in C# and XAML.

  • ASP.NET Core OData 8 Preview Supports .NET 5, but with Breaking Changes

    ASP.NET Core OData, which debuted in July 2018, is out in a v8.0 preview that for the first time supports the upcoming .NET 5 milestone release.

Upcoming Events