PT-2018-9067 · Microsoft+1 · Powershell Core+3

Published 2018-01-09 · Updated 2021-08-12 · CVE-2018-0786

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft .NET Framework versions 2.0 SP2 through 4.7.1 .NET Core versions 1.0 through 2.0 PowerShell Core version 6.0.0

Description: A security feature bypass issue exists due to the way certificates are validated. This occurs when components do not completely validate certificates, allowing an attacker to present a certificate marked invalid for a specific use, but the component uses it for that purpose, disregarding the Enhanced Key Usage taggings.

Recommendations: For Microsoft .NET Framework versions 2.0 SP2 through 4.7.1, update to a version that includes the security fix for the certificate validation issue. For .NET Core versions 1.0 through 2.0, apply the necessary security patches to address the certificate validation vulnerability. For PowerShell Core version 6.0.0, consider disabling the use of certificates until a patch is available that properly validates certificates.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2018-1137

ALT-PU-2018-1276

ALT-PU-2018-1277

ALT-PU-2018-1278

ALT-PU-2018-1279

CVE-2018-0786

GHSA-JC8G-XHW5-6X46

Affected Products

Net Core

.Net Framework

Alt Linux

Powershell Core

References · 19

• https://errata.altlinux.org/ALT-PU-2018-1278 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0786 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0786 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0786 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0786 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jc8g-xhw5-6x46 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2018-1279 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0764 · Security Note
• https://errata.altlinux.org/ALT-PU-2018-1137 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2018-1277 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2018-1276 · Vendor Advisory
• https://github.com/github/advisory-database/issues/302 · Note
• https://github.com/dotnet/announcements/issues/51 · Note
• https://github.com/advisories/GHSA-jc8g-xhw5-6x46 · Note
• https://packages.altlinux.org/ru/vuln/CVE-2018-0786 · Note