Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA11315
HistorySep 11, 2018 - 12:00 a.m.

KLA11315 Multiple vulnerabilities in Microsoft Developer Tools

2018-09-1100:00:00
Kaspersky Lab
threats.kaspersky.com
802

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.477 Medium

EPSS

Percentile

97.4%

JSON

Detect date:

09/11/2018

Severity:

Critical

Description:

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code, spoof user interface.

Affected products:

Microsoft.Data.OData
.NET Core 2.1
ASP.NET Core 2.1
System.IO.Pipelines
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5.1
Microsoft .NET Framework 4.5.2
Microsoft .NET Framework 4.6
Microsoft .NET Framework 4.7.2
Microsoft .NET Framework 4.7.1/4.7.2
ASP.NET Core 2.2
Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2
Microsoft .NET Framework 4.7/4.7.1/4.7.2
C SDK for Azure IoT

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2018-8409
CVE-2018-8269
CVE-2018-8421
CVE-2018-8479

Impacts:

ACE

Related products:

Microsoft .NET Framework

CVE-IDS:

CVE-2018-82695.0Warning
CVE-2018-84796.8High
CVE-2018-84095.0Warning

KB list:

4457128
4457056
4457028
4457131
4457132
4457025
4457054
4457044
4457034
4457037
4457027
4457045
4457029
4457142
4457030
4457043
4457055
4457035
4457138
4457036
4457042
4457033
4457026
4457053
4457038

Microsoft official advisories:

Exploitation:

Public exploits exist for this vulnerability.

References

Related

osv 3
openvas 16
prion 4
veracode 3
zdt 1
github 2
mscve 4
cve 4
exploitpack 1
symantec 4
packetstorm 1
nessus 11
redhatcve 2
mskb 35
exploitdb 1
krebs 1
threatpost 1
ibm 1
talosblog 1
osv
osv
Denial of service in ASP.NET Core
2018-10-16 19:58:31
Denial of service vulnerability exists when System.IO.Pipelines improperly handles requests
2018-10-16 19:56:38
CVE-2018-8409
2018-09-13 00:29:02
openvas
openvas
.NET Core OData Denial of Service Vulnerability - Windows
2023-08-07 00:00:00
'Microsoft.Data.OData' Denial of Service Vulnerability (Sep 2018) - Windows
2018-09-17 00:00:00
ASP.NET Core SDK 'System.IO.Pipelines' Denial of Service Vulnerability (Sep 2018) - Windows
2018-09-14 00:00:00
prion
prion
Denial of service
2018-09-13 00:29:00
Denial of service
2018-09-13 00:29:00
Spoofing
2018-09-13 00:29:00
veracode
veracode
Denial Of Service (DoS)
2018-09-14 07:08:23
Denial Of Service (DoS)
2018-09-13 09:53:23
Server Spoofing
2018-09-14 09:17:08
zdt
zdt
Microsoft Office SharePoint Server 2016 - Denial of Service Exploit
2019-01-09 00:00:00
github
github
Denial of service in ASP.NET Core
2018-10-16 19:58:31
Denial of service vulnerability exists when System.IO.Pipelines improperly handles requests
2018-10-16 19:56:38
mscve
mscve
System.IO.Pipelines Denial of Service
2018-09-11 07:00:00
OData Denial of Service Vulnerability
2018-09-11 07:00:00
Azure IoT SDK Spoofing Vulnerability
2018-09-11 07:00:00
cve
cve
CVE-2018-8409
2018-09-13 00:29:00
CVE-2018-8269
2018-09-13 00:29:00
CVE-2018-8479
2018-09-13 00:29:00
exploitpack
exploitpack
Microsoft Office SharePoint Server 2016 - Denial of Service (Metasploit)
2019-01-09 00:00:00
symantec
symantec
Microsoft OData CVE-2018-8269 Denial of Service Vulnerability
2018-09-11 00:00:00
Microsoft System.IO.Pipelines CVE-2018-8409 Denial of Service Vulnerability
2018-09-11 00:00:00
Microsoft Azure IoT SDK CVE-2018-8479 Spoofing Vulnerability
2018-09-11 00:00:00
packetstorm
packetstorm
Microsoft Office SharePoint Server 2016 Denial Of Service
2019-01-09 00:00:00
nessus
nessus
Security Updates for Microsoft .NET core and ASP.NET Core (DoS) (September 2018)
2018-09-13 00:00:00
Security Updates for Microsoft .NET Framework (September 2018)
2018-09-12 00:00:00
KB4457984: Windows Server 2008 September 2018 Security Update
2018-09-11 00:00:00
redhatcve
redhatcve
CVE-2018-8409
2018-09-14 01:19:39
CVE-2018-8421
2020-03-29 13:52:09
mskb
mskb
Description of the Security and Quality Rollup for .NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, and 4.7.2 for Windows Server 2012 (KB 4457033)
2018-09-11 07:00:00
Description of the Security Only update for .NET Framework 4.5.2 for Windows 7 SP1, Server 2008 R2 SP1, and Server 2008 SP2 (KB 4457030)
2018-09-11 07:00:00
Security Only updates for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, and 4.7.2 for Windows 8.1 and Server 2012 R2 (KB 4457916)
2018-10-11 00:00:00
exploitdb
exploitdb
Microsoft Office SharePoint Server 2016 - Denial of Service (Metasploit)
2019-01-09 00:00:00
krebs
krebs
Patch Tuesday, September 2018 Edition
2018-09-11 20:35:27
threatpost
threatpost
Microsoft Patches Actively Exploited Bug as Part of Patch Tuesday
2018-09-11 21:04:17
ibm
ibm
Security Bulletin: Multiple Vulnerabilities may affect IBM Robotic Process Automation
2022-05-04 18:53:46
talosblog
talosblog
Microsoft Patch Tuesday - September 2018
2018-09-11 11:56:00

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.477 Medium

EPSS

Percentile

97.4%

JSON
Related for KLA11315
osv3openvas16prion4veracode3zdt1github2mscve4cve4exploitpack1symantec4packetstorm1nessus11redhatcve2mskb35exploitdb1krebs1threatpost1ibm1talosblog1