QID 91977

Date Published: 2023-02-15

QID 91977: Microsoft .NET Framework Security Update for February 2023

A Denial of Service and Remote Code Execution Vulnerability exist in Microsoft .Net Framework.

Following KBs are covered in this detection:
KB5022838
KB5022503
KB5022729
KB5022732
KB5022784
KB5022727
KB5022782
KB5022731
KB5022783
KB5022858
KB5022734
KB5022786
KB5022497
KB5022728
KB5022730
KB5022735
KB5022733
KB5022785

This security update is rated Important for supported versions of Microsoft .NET Framework.

.NET Framework 2.0, 3.0, 3.5, 3.5.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, and 4.8.1

QID Detection Logic (Authenticated):
Checks for vulnerable file.version of ntoskrnl.exe or Mscorlib.dll or System.core.dll for the respective .Net Framework KBs

Successful exploitation may allow a attacker to perform Denial of Service or Remote Code Execution Vulnerability.

CVSS V3 rated as High - 7.8 severity.

CVSS V2 rated as High - 7.2 severity.

Solution

Customers are advised to refer to CVE-2023-21722 and CVE-2023-21808 for more details pertaining to these vulnerabilities.

Vendor References

KB5022497 - support.microsoft.com/help/5022497
KB5022503 - support.microsoft.com/help/5022503
KB5022727 - support.microsoft.com/help/5022727
KB5022728 - support.microsoft.com/help/5022728
KB5022729 - support.microsoft.com/help/5022729
KB5022730 - support.microsoft.com/help/5022730
KB5022731 - support.microsoft.com/help/5022731
KB5022732 - support.microsoft.com/help/5022732
KB5022733 - support.microsoft.com/help/5022733
KB5022734 - support.microsoft.com/help/5022734
KB5022735 - support.microsoft.com/help/5022735
KB5022782 - support.microsoft.com/help/5022782
KB5022783 - support.microsoft.com/help/5022783
KB5022784 - support.microsoft.com/help/5022784
KB5022785 - support.microsoft.com/help/5022785
KB5022786 - support.microsoft.com/help/5022786
KB5022838 - support.microsoft.com/help/5022838
KB5022858 - support.microsoft.com/help/5022858

CVEs related to QID 91977

CVE-2023-21722 | CVE-2023-21808 |

Software Advisories

Advisory ID	Software	Component	Link
CVE-2023-21722			msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21722
CVE-2023-21808			msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21808

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].