News
Security Issues Hit .NET Core, Visual Studio
A recent Microsoft security update addresses a .NET Core security feature bypass vulnerability.
Microsoft on Tuesday announced several .NET Core security update downloads and updated several Docker images to address the vulnerability (the company always releases security updates on the second Tuesday of the month, commonly called Patch Tuesday).
Officially called CVE-2018-8356, the feature bypass vulnerability "exists when .NET Core does not correctly validate certificates. An attacker who successfully exploited this vulnerability could present an expired certificate when challenged," Microsoft said. The update corrects how .NET Core applications handle certificate validation.
Microsoft also issued security updates for several versions of Visual Studio and Expression Blend to address a remote code execution vulnerability dubbed CVE-2018-8172, though the company said it wasn't publicly disclosed or exploited, with exploitation "less likely" for both the latest and older software releases.
Here's Microsoft's description of the issue:
A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an unbuilt project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Visual Studio. In an email attack scenario, an attacker could exploit the vulnerability by sending a specially crafted project, or resource file, to the user and convince the user to open the file.
The security update addresses the vulnerability by correcting how Visual Studio checks the source markup of a file.
Further down the company's Exploitability Assessment ladder (judged "exploitation unlikely") was an ASP.NET security feature bypass vulnerability, officially named CVE-2018-8171, existing "in ASP.NET when the number of incorrect login attempts is not validated."
About the Author
David Ramel is an editor and writer for Converge360.