Test ID:	1.3.6.1.4.1.25623.1.1.12.2023.6161.2
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-6161-2)
Summary:	The remote host is missing an update for the 'dotnet6, dotnet7' package(s) announced via the USN-6161-2 advisory.
Description:	Summary: The remote host is missing an update for the 'dotnet6, dotnet7' package(s) announced via the USN-6161-2 advisory. Vulnerability Insight: USN-6161-1 fixed vulnerabilities in .NET. The update introduced a regression with regards to how the runtime imported X.509 certificates. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that .NET did not properly enforce certain restrictions when deserializing a DataSet or DataTable from XML. An attacker could possibly use this issue to elevate their privileges. (CVE-2023-24936) Kevin Jones discovered that .NET did not properly handle the AIA fetching process for X.509 client certificates. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-29331) Kalle Niemitalo discovered that the .NET package manager, NuGet, was susceptible to a potential race condition. An attacker could possibly use this issue to perform remote code execution. (CVE-2023-29337) Tom Deseyn discovered that .NET did not properly process certain arguments when extracting the contents of a tar file. An attacker could possibly use this issue to elevate their privileges. This issue only affected the dotnet7 package. (CVE-2023-32032) It was discovered that .NET did not properly handle memory in certain circumstances. An attacker could possibly use this issue to cause a denial of service or perform remote code execution. (CVE-2023-33128) Affected Software/OS: 'dotnet6, dotnet7' package(s) on Ubuntu 22.04, Ubuntu 22.10, Ubuntu 23.04. Solution: Please install the updated package(s). CVSS Score: 7.8 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-24936 .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24936 Common Vulnerability Exposure (CVE) ID: CVE-2023-29331 .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29331 Common Vulnerability Exposure (CVE) ID: CVE-2023-29337 NuGet Client Remote Code Execution Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29337 Common Vulnerability Exposure (CVE) ID: CVE-2023-32032 .NET and Visual Studio Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32032 Common Vulnerability Exposure (CVE) ID: CVE-2023-33128 .NET and Visual Studio Remote Code Execution Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33128
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.