Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA11172
HistoryJan 09, 2018 - 12:00 a.m.

KLA11172 Multiple vulnerabilities in Microsoft Development Tools

2018-01-0900:00:00
Kaspersky Lab
threats.kaspersky.com
64

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

76.2%

JSON

Detect date:

01/09/2018

Severity:

Critical

Description:

Multiple serious vulnerabilities have been found in Microsoft .NET Core, ASP.NET Core, Microsoft Excel and Microsoft Office Compatibility Pack. Malicious users can exploit these vulnerabilities to spoof user interface, obtain sensitive information, bypass security restrictions and gain privileges.

Affected products:

Microsoft .NET Framework 4.7.1

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2018-0784
CVE-2018-0785
CVE-2018-0786
CVE-2018-0764

Impacts:

ACE

Related products:

Microsoft .NET Framework

CVE-IDS:

CVE-2018-07846.8High
CVE-2018-07854.3Warning
CVE-2018-07865.0Warning
CVE-2018-07645.0Warning

Microsoft official advisories:

KB list:

4056888
4056890
4056893
4056891
4056892
4054176
4054177
4054174
4054175
4054172
4054995
4054170
4054171
4054998
4054999
4054181
4054997
4054996
4054993
4055001
4055000
4055002
4054994
4054182
4054183
4074880

References

Related

nessus 5
openvas 18
altlinux 10
mskb 34
symantec 4
veracode 4
mscve 4
redhatcve 2
osv 7
prion 5
cve 5
github 2
redhat 1
krebs 1
threatpost 1
thn 1
talosblog 1
trendmicroblog 1
nessus
nessus
Security Update for ASP.NET Core January 2018
2018-01-13 00:00:00
Security Update for .NET Core (January 2018) (macOS)
2018-01-10 00:00:00
Security and Quality Rollup for .NET Framework (January 2018)
2018-01-10 00:00:00
openvas
openvas
ASP.NET Core Multiple Vulnerabilities - Windows
2018-02-27 00:00:00
Microsoft .NET Framework 4.5.2 Multiple Vulnerabilities (KB4054994)
2018-01-10 00:00:00
Microsoft PowerShell Core DoS And Security Feature Bypass Vulnerabilities - Mac OS X
2018-01-30 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 10 package dotnet-bootstrap-3.1 version 2.0.5-alt1
2018-02-05 00:00:00
Security fix for the ALT Linux 10 package dotnet-coreclr-3.1 version 2.0.5-alt1
2018-02-22 00:00:00
Security fix for the ALT Linux 8 package dotnet-bootstrap version 2.0.5-alt1
2018-02-05 00:00:00
mskb
mskb
Description of the Security and Quality Rollup for the .NET Framework 4.5.2 for Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Server 2008 SP2 (KB 4054995)
2018-01-09 08:00:00
Security Only update for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 updates for Windows 7 SP1 and Windows Server 2008 R2 SP1 (KB 4055269)
2018-01-20 00:00:00
Security Only update for .NET Framework 3.5 SP1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 updates for Windows Server 2012 (KB 4055270)
2018-01-20 00:00:00
symantec
symantec
Microsoft ASP.NET Core CVE-2018-0784 Remote Privilege Escalation Vulnerability
2018-01-09 00:00:00
Microsoft .NET Framework CVE-2018-0786 Security Bypass Vulnerability
2018-01-09 00:00:00
Microsoft ASP.NET Core CVE-2018-0785 Cross Site Request Forgery Vulnerability
2018-01-09 00:00:00
veracode
veracode
Privilege Escalation
2018-07-02 04:24:49
Certificate Validation Bypass
2018-07-04 05:05:53
Denial Of Service (DoS)
2018-07-05 02:32:00
mscve
mscve
ASP.NET Core Elevation Of Privilege Vulnerability
2018-01-09 08:00:00
.NET Security Feature Bypass Vulnerability
2018-01-09 08:00:00
ASP.NET Core Cross Site Request Forgery Vulnerabilty
2018-01-09 08:00:00
redhatcve
redhatcve
CVE-2018-0786
2018-01-12 04:49:52
CVE-2018-0764
2018-01-12 04:49:33
osv
osv
CVE-2018-0785
2018-01-10 01:29:00
Improper Certificate Validation in Microsoft .NET Framework components
2018-10-16 19:59:05
CVE-2018-0786
2018-01-10 01:29:00
prion
prion
Cross site request forgery (csrf)
2018-01-10 01:29:00
Security feature bypass
2018-01-10 01:29:00
Privilege escalation
2018-01-10 01:29:00
cve
cve
CVE-2018-0785
2018-01-10 01:29:00
CVE-2018-0786
2018-01-10 01:29:00
CVE-2018-0784
2018-01-10 01:29:00
github
github
Improper Certificate Validation in Microsoft .NET Framework components
2018-10-16 19:59:05
Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents
2018-10-16 17:34:00
redhat
redhat
(RHSA-2018:0379) Moderate: .NET Core on Red Hat Enterprise Linux security update
2018-03-01 05:56:46
krebs
krebs
Flash, Windows Users: It’s Time to Patch
2018-03-13 19:36:28
threatpost
threatpost
Microsoft January Patch Tuesday Update Fixes 16 Critical Bugs
2018-01-09 16:25:06
thn
thn
Microsoft Releases Patches for 16 Critical Flaws, Including a Zero-Day
2018-01-09 19:35:00
talosblog
talosblog
Microsoft Patch Tuesday - January 2018
2018-01-09 13:36:00
trendmicroblog
trendmicroblog
TippingPoint Threat Intelligence and Zero-Day Coverage – Week of January 8, 2018
2018-01-12 15:09:44

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

76.2%

JSON
Related for KLA11172
nessus5openvas18altlinux10mskb34symantec4veracode4mscve4redhatcve2osv7prion5cve5github2redhat1krebs1threatpost1thn1talosblog1trendmicroblog1