Vulnerabilities > CVE-2020-1161 - Unspecified vulnerability in Microsoft Asp.Net Core and Visual Studio 2017

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
microsoft
nessus
NVD
Published: 2020-05-21
Updated: 2021-07-21

Summary

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.

Vulnerable Configurations

Part Description Count
Application
Microsoft
121

Nessus

  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-2250.NASL
    descriptionThe remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2250 advisory. - dotnet: Denial of service via untrusted input (CVE-2020-1108) - dotnet: Denial of service due to infinite loop (CVE-2020-1161) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-05-31
    modified2020-05-22
    plugin id136820
    published2020-05-22
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136820
    titleRHEL 8 : dotnet3.1 (RHSA-2020:2250)
  • NASL familyWindows
    NASL idSMB_NT_MS20_MAY_ASPDOTNET_CORE.NASL
    descriptionThe Microsoft ASP.NET Core installation on the remote host is version 3.x < 3.1.4. It is, therefore, affected by a denial of service (DoS) vulnerability when ASP.NET Core improperly handles web requests. An unauthenticated, remote attacker can exploit this issue, via sending a specially crafted requests to the ASP.NET Core application to cause the application to stop responding.
    last seen2020-05-18
    modified2020-05-13
    plugin id136527
    published2020-05-13
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136527
    titleSecurity Update for Microsoft ASP.NET Core (DoS) (May 2020)
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS20_MAY_VISUAL_STUDIO.NASL
    descriptionThe Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication. (CVE-2020-1108) - A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. (CVE-2020-1161)
    last seen2020-06-10
    modified2020-05-12
    plugin id136515
    published2020-05-12
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136515
    titleSecurity Updates for Microsoft Visual Studio Products (May 2020)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2020-2250.NASL
    descriptionFrom Red Hat Security Advisory 2020:2250 : The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2250 advisory. - dotnet: Denial of service via untrusted input (CVE-2020-1108) - dotnet: Denial of service due to infinite loop (CVE-2020-1161) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-12
    modified2020-06-11
    plugin id137345
    published2020-06-11
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/137345
    titleOracle Linux 8 : dotnet3.1 (ELSA-2020-2250)

Redhat

advisories
bugzilla
id1827645
titleCVE-2020-1161 dotnet: Denial of service due to infinite loop
oval
OR
  • commentRed Hat Enterprise Linux must be installed
    ovaloval:com.redhat.rhba:tst:20070304026
  • AND
    • commentRed Hat Enterprise Linux 8 is installed
      ovaloval:com.redhat.rhba:tst:20193384074
    • OR
      • AND
        • commentdotnet3.1-debugsource is earlier than 0:3.1.104-2.el8_2
          ovaloval:com.redhat.rhsa:tst:20202250001
        • commentdotnet3.1-debugsource is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20202250002
      • AND
        • commentnetstandard-targeting-pack-2.1 is earlier than 0:3.1.104-2.el8_2
          ovaloval:com.redhat.rhsa:tst:20202250003
        • commentnetstandard-targeting-pack-2.1 is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20200130004
      • AND
        • commentdotnet-templates-3.1 is earlier than 0:3.1.104-2.el8_2
          ovaloval:com.redhat.rhsa:tst:20202250005
        • commentdotnet-templates-3.1 is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20202250006
      • AND
        • commentdotnet-targeting-pack-3.1 is earlier than 0:3.1.4-2.el8_2
          ovaloval:com.redhat.rhsa:tst:20202250007
        • commentdotnet-targeting-pack-3.1 is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20202250008
      • AND
        • commentdotnet-sdk-3.1 is earlier than 0:3.1.104-2.el8_2
          ovaloval:com.redhat.rhsa:tst:20202250009
        • commentdotnet-sdk-3.1 is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20202250010
      • AND
        • commentdotnet-runtime-3.1 is earlier than 0:3.1.4-2.el8_2
          ovaloval:com.redhat.rhsa:tst:20202250011
        • commentdotnet-runtime-3.1 is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20202250012
      • AND
        • commentdotnet-hostfxr-3.1 is earlier than 0:3.1.4-2.el8_2
          ovaloval:com.redhat.rhsa:tst:20202250013
        • commentdotnet-hostfxr-3.1 is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20202250014
      • AND
        • commentdotnet-host is earlier than 0:3.1.4-2.el8_2
          ovaloval:com.redhat.rhsa:tst:20202250015
        • commentdotnet-host is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20191259010
      • AND
        • commentdotnet-apphost-pack-3.1 is earlier than 0:3.1.4-2.el8_2
          ovaloval:com.redhat.rhsa:tst:20202250017
        • commentdotnet-apphost-pack-3.1 is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20202250018
      • AND
        • commentdotnet is earlier than 0:3.1.104-2.el8_2
          ovaloval:com.redhat.rhsa:tst:20202250019
        • commentdotnet is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20191259004
      • AND
        • commentaspnetcore-targeting-pack-3.1 is earlier than 0:3.1.4-2.el8_2
          ovaloval:com.redhat.rhsa:tst:20202250021
        • commentaspnetcore-targeting-pack-3.1 is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20202250022
      • AND
        • commentaspnetcore-runtime-3.1 is earlier than 0:3.1.4-2.el8_2
          ovaloval:com.redhat.rhsa:tst:20202250023
        • commentaspnetcore-runtime-3.1 is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20202250024
rhsa
idRHSA-2020:2250
released2020-05-21
severityImportant
titleRHSA-2020:2250: dotnet3.1 security update (Important)
rpms
  • rh-dotnet31-aspnetcore-runtime-3.1-0:3.1.4-2.el7
  • rh-dotnet31-aspnetcore-targeting-pack-3.1-0:3.1.4-2.el7
  • rh-dotnet31-dotnet-0:3.1.104-2.el7
  • rh-dotnet31-dotnet-apphost-pack-3.1-0:3.1.4-2.el7
  • rh-dotnet31-dotnet-debuginfo-0:3.1.104-2.el7
  • rh-dotnet31-dotnet-host-0:3.1.4-2.el7
  • rh-dotnet31-dotnet-hostfxr-3.1-0:3.1.4-2.el7
  • rh-dotnet31-dotnet-runtime-3.1-0:3.1.4-2.el7
  • rh-dotnet31-dotnet-sdk-3.1-0:3.1.104-2.el7
  • rh-dotnet31-dotnet-targeting-pack-3.1-0:3.1.4-2.el7
  • rh-dotnet31-dotnet-templates-3.1-0:3.1.104-2.el7
  • rh-dotnet31-netstandard-targeting-pack-2.1-0:3.1.104-2.el7
  • aspnetcore-runtime-3.1-0:3.1.4-2.el8_2
  • aspnetcore-targeting-pack-3.1-0:3.1.4-2.el8_2
  • dotnet-0:3.1.104-2.el8_2
  • dotnet-apphost-pack-3.1-0:3.1.4-2.el8_2
  • dotnet-apphost-pack-3.1-debuginfo-0:3.1.4-2.el8_2
  • dotnet-host-0:3.1.4-2.el8_2
  • dotnet-host-debuginfo-0:3.1.4-2.el8_2
  • dotnet-hostfxr-3.1-0:3.1.4-2.el8_2
  • dotnet-hostfxr-3.1-debuginfo-0:3.1.4-2.el8_2
  • dotnet-runtime-3.1-0:3.1.4-2.el8_2
  • dotnet-runtime-3.1-debuginfo-0:3.1.4-2.el8_2
  • dotnet-sdk-3.1-0:3.1.104-2.el8_2
  • dotnet-sdk-3.1-debuginfo-0:3.1.104-2.el8_2
  • dotnet-targeting-pack-3.1-0:3.1.4-2.el8_2
  • dotnet-templates-3.1-0:3.1.104-2.el8_2
  • dotnet3.1-debuginfo-0:3.1.104-2.el8_2
  • dotnet3.1-debugsource-0:3.1.104-2.el8_2
  • netstandard-targeting-pack-2.1-0:3.1.104-2.el8_2

References