CVE-2024-43499

Unchecked Input for Loop Condition (CWE-606)

Published: Nov 12, 2024

010
CVSS 7.5EPSS 0.05%High
CVE info copied to clipboard

Summary

The NrbfDecoder component in .NET 9 contains a denial of service vulnerability due to incorrect input validation. This vulnerability affects the .NET 9.0 framework.

Impact

This vulnerability could allow an attacker to cause a denial of service condition in applications using the affected .NET 9.0 framework. The attack vector is network-based, requiring no user interaction and no privileges. The vulnerability has a high impact on system availability, potentially causing disruption to services or applications built on .NET 9.0. The CVSS base score for this vulnerability is 7.5, indicating a high severity level.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available for this vulnerability. Microsoft has released updates to address this issue, and patches can be obtained from the Microsoft Update Guide. The patch was made available on November 12, 2024.

Mitigation

1. Update to the latest patched version of .NET 9.0 as soon as possible. 2. Monitor and limit network access to systems running .NET 9.0 applications until the patch can be applied. 3. Implement network segmentation to minimize the potential impact of a successful attack. 4. Review and validate input handling in applications using the NrbfDecoder component. 5. Keep systems and applications up-to-date with the latest security patches from Microsoft.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Timeline

CVSS

A CVSS base score of 7.5 has been assigned.

Nov 12, 2024 at 5:55 PM / microsoft
First Article

Feedly found the first article mentioning CVE-2024-43499. See article

Nov 12, 2024 at 6:00 PM / Microsoft Security Advisories - MSRC
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Nov 12, 2024 at 6:02 PM
CVE Assignment

NVD published the first details for CVE-2024-43499

Nov 12, 2024 at 6:15 PM
Vendor Advisory

GitHub Advisories released a security advisory.

Nov 12, 2024 at 7:26 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (210867)

Nov 13, 2024 at 2:15 AM
Vendor Advisory

RedHat CVE advisory released a security advisory (CVE-2024-43499).

Nov 13, 2024 at 5:35 AM
CVSS

A CVSS base score of 7.5 has been assigned.

Nov 13, 2024 at 5:35 AM / redhat-cve-advisories
Vendor Advisory

RedHat released a security advisory (RHSA-2024:9543).

Nov 13, 2024 at 8:00 AM
Static CVE Timeline Graph

Affected Systems

Microsoft/visual_studio_2022
+null more

Patches

Microsoft
+null more

References

.NET and Visual Studio Denial of Service Vulnerability
.NET 9.0 installed on Windows .NET 9.0 installed on Linux

News

oracle_linux ELSA-2024-9543: ELSA-2024-9543: .NET 9.0 security update (IMPORTANT)
Released Last Updated: 11/20/2024 CVEs: CVE-2024-43499 , CVE-2024-43498 Plugins: 211615
alma_linux ALSA-2024:9543: ALSA-2024:9543: .NET 9.0 security update (High)
Released Last Updated: 11/19/2024 CVEs: CVE-2024-43499 , CVE-2024-43498 Plugins: 211577
AlmaLinux 9 : .NET 9.0 (ALSA-2024:9543)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:9543 advisory. The remote AlmaLinux host is missing one or more security updates.
[ALSA-2024:9543] Important: .NET 9.0 security update
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
2024-45 - Adobe, Mozilla, Canonical, Red Hat, Microsoft, Google, Jenkins, GitHub, Spring 🗂️
Advisory Week Week 45, 2024 National Cyber Awareness System CISA Releases Nineteen Industrial Control Systems Advisories CISA Adds Two Known Exploited Vulnerabilities to Catalog Palo Alto Networks Emphasizes Hardening Guidance Fortinet Releases Security Updates for Multiple Products Microsoft Releases November 2024 Security Updates Adobe Releases Security Updates for Multiple Products Ivanti Releases Security Updates for Multiple Products JCDC’s Collaborative Efforts Enhance Cybersecurity for the 2024 Olympic and Paralympic Games Citrix Releases Security Updates for NetScaler and Citrix Session Recording CISA Releases Five Industrial Control Systems Advisories CISA, FBI, NSA, and International Partners Release Joint Advisory on 2023 Top Routinely Exploited Vulnerabilities CISA Adds Five Known Exploited Vulnerabilities to Catalog Adobe Security Bulletins and Advisories Security updates available for Adobe Photoshop APSB24-89 Security Updates Available for Adobe Commerce APSB24-90 Security Updates Available for Adobe Illustrator APSB24-66 APSB24-87 Security Update Available for Adobe InDesign APSB24-88 Security Updates Available for Adobe Bridge APSB24-77 Security Updates Available for Adobe Audition APSB24-83 Mozilla Security Advisories Security Vulnerabilities fixed in Thunderbird 132.0.1 mfsa2024-62 Security Vulnerabilities fixed in Thunderbird 128.4.3 mfsa2024-61 Ubuntu Security Notices Linux kernel vulnerabilities: USN-7089-6 / USN-7088-5 / USN-7089-5 / USN-7110-1 / USN-7089-4 / USN-7100-2 / USN-7100-1 GD Graphics Library vulnerability: USN-7112-1 Go vulnerabilities: USN-7111-1 / USN-7109-1 Linux kernel vulnerability:
See 46 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:None
Integrity:None
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI