what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Ubuntu Security Notice USN-6278-1

Ubuntu Security Notice USN-6278-1
Posted Aug 9, 2023
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 6278-1 - It was discovered that .NET did not properly handle the execution of certain commands. An attacker could possibly use this issue to achieve remote code execution. Benoit Foucher discovered that .NET did not properly implement the QUIC stream limit in HTTP/3. An attacker could possibly use this issue to cause a denial of service. It was discovered that .NET did not properly handle the disconnection of potentially malicious clients interfacing with a Kestrel server. An attacker could possibly use this issue to cause a denial of service.

tags | advisory, remote, web, denial of service, code execution
systems | linux, ubuntu
advisories | CVE-2023-35390, CVE-2023-38178, CVE-2023-38180
SHA-256 | 398492662e44a0c763fee25f39cae11943767ba032c8f6482dec1ab6f6617eaf

Ubuntu Security Notice USN-6278-1

Change Mirror Download
==========================================================================
Ubuntu Security Notice USN-6278-1
August 08, 2023

dotnet6, dotnet7 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.04

Summary:

Several security issues were fixed in .NET.

Software Description:
- dotnet6: dotNET CLI tools and runtime
- dotnet7: dotNET CLI tools and runtime

Details:

It was discovered that .NET did not properly handle the execution of
certain commands. An attacker could possibly use this issue to
achieve remote code execution. (CVE-2023-35390)

Benoit Foucher discovered that .NET did not properly implement the
QUIC stream limit in HTTP/3. An attacker could possibly use this
issue to cause a denial of service. (CVE-2023-38178)

It was discovered that .NET did not properly handle the disconnection
of potentially malicious clients interfacing with a Kestrel server. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2023-38180)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
aspnetcore-runtime-6.0 6.0.121-0ubuntu1~23.04.1
aspnetcore-runtime-7.0 7.0.110-0ubuntu1~23.04.1
dotnet-host 6.0.121-0ubuntu1~23.04.1
dotnet-host-7.0 7.0.110-0ubuntu1~23.04.1
dotnet-hostfxr-6.0 6.0.121-0ubuntu1~23.04.1
dotnet-hostfxr-7.0 7.0.110-0ubuntu1~23.04.1
dotnet-runtime-6.0 6.0.121-0ubuntu1~23.04.1
dotnet-runtime-7.0 7.0.110-0ubuntu1~23.04.1
dotnet-sdk-6.0 6.0.121-0ubuntu1~23.04.1
dotnet-sdk-7.0 7.0.110-0ubuntu1~23.04.1
dotnet6 6.0.121-0ubuntu1~23.04.1
dotnet7 7.0.110-0ubuntu1~23.04.1

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6278-1
CVE-2023-35390, CVE-2023-38178, CVE-2023-38180

Package Information:
https://launchpad.net/ubuntu/+source/dotnet6/6.0.121-0ubuntu1~23.04.1
https://launchpad.net/ubuntu/+source/dotnet7/7.0.110-0ubuntu1~23.04.1

Login or Register to add favorites

File Archive:

June 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    0 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    18 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    57 Files
  • 7
    Jun 7th
    6 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    12 Files
  • 11
    Jun 11th
    27 Files
  • 12
    Jun 12th
    38 Files
  • 13
    Jun 13th
    16 Files
  • 14
    Jun 14th
    14 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close