QID 92042

Date Published: 2023-08-09

QID 92042: Microsoft .NET Framework Security Update for August 2023

An Elevation of Privileges and Spoofing Vulnerabilities exist in Microsoft .Net Framework.

Following KBs are covered in this detection:
KB5029654
KB5029569
KB5029649
KB5029655
KB5029653
KB5029568
KB5029647
KB5029650
KB5028952
KB5028948
KB5029648
KB5029652
KB5029567
KB5029651
KB5029566

This security update is rated Important for supported versions of Microsoft .NET Framework.
.NET Framework 2.0, 3.0, 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, and 4.8.1

QID Detection Logic (Authenticated):
Checks for vulnerable file version of ntoskrnl.exe or Mscorlib.dll or System.core.dll or System.web.dll for the respective .Net Framework KBs

Successful exploitation may allow a attacker to exploit Elevation of Privileges and/or Spoofing vulnerabilities.

CVSS V3 rated as Critical - 8.8 severity.

CVSS V2 rated as High - 7.1 severity.

Solution

Customers are advised to refer to CVE-2023-36899 and CVE-2023-36873 for more details pertaining to these vulnerabilities.

Vendor References

KB5028948 - support.microsoft.com/help/5028948
KB5028952 - support.microsoft.com/help/5028952
KB5029566 - support.microsoft.com/help/5029566
KB5029567 - support.microsoft.com/help/5029567
KB5029568 - support.microsoft.com/help/5029568
KB5029569 - support.microsoft.com/help/5029569
KB5029647 - support.microsoft.com/help/5029647
KB5029648 - support.microsoft.com/help/5029648
KB5029649 - support.microsoft.com/help/5029649
KB5029650 - support.microsoft.com/help/5029650
KB5029651 - support.microsoft.com/help/5029651
KB5029652 - support.microsoft.com/help/5029652
KB5029653 - support.microsoft.com/help/5029653
KB5029654 - support.microsoft.com/help/5029654
KB5029655 - support.microsoft.com/help/5029655

CVEs related to QID 92042

CVE-2023-36899 | CVE-2023-36873 |

Software Advisories

Advisory ID	Software	Component	Link
CVE-2023-36873			msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36873
CVE-2023-36899			msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36899

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].