7.5

CVE-2018-0786

EPSS 1.55%
Veröffentlicht 10.01.2018 01:29:00
Zuletzt bearbeitet 21.11.2024 03:38:56
Quelle secure@microsoft.com
Teams Watchlist Login
Unerledigt Login

Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature Bypass Vulnerability."

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 6

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Microsoft ≫ .Net Core Version1.0

Microsoft ≫ .Net Core Version2.0

Microsoft ≫ Powershell Core Version6.0

Microsoft ≫ .Net Framework Version2.0 Updatesp2

Microsoft ≫ Windows Server 2008 Version- Updatesp2

Microsoft ≫ .Net Framework Version3.0 Updatesp2

Microsoft ≫ Windows Server 2008 Version- Updatesp2

Microsoft ≫ .Net Framework Version3.5

   Microsoft ≫ Windows 10 Version-
   Microsoft ≫ Windows 10 Version1511
   Microsoft ≫ Windows 10 Version1607
   Microsoft ≫ Windows 10 Version1703
   Microsoft ≫ Windows 10 Version1709
   Microsoft ≫ Windows 8.1 Version-
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2
   Microsoft ≫ Windows Server 2016 Version-

Microsoft ≫ .Net Framework Version3.5.1

   Microsoft ≫ Windows 7 Version- Updatesp1
   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformitanium
   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64

Microsoft ≫ .Net Framework Version4.5.2

   Microsoft ≫ Windows 7 Version- Updatesp1
   Microsoft ≫ Windows 8.1 Version-
   Microsoft ≫ Windows Rt 8.1 Version-
   Microsoft ≫ Windows Server 2008 Version- Updatesp2
   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2

Microsoft ≫ .Net Framework Version4.6

Microsoft ≫ Windows 10 Version-
Microsoft ≫ Windows Server 2008 Version- Updatesp2

Microsoft ≫ .Net Framework Version4.6.1

Microsoft ≫ Windows 10 Version1511

Microsoft ≫ .Net Framework Version4.6.2

Microsoft ≫ Windows 10 Version1607
Microsoft ≫ Windows Server 2016 Version-

Microsoft ≫ .Net Framework Version4.7

Microsoft ≫ Windows 10 Version1607
Microsoft ≫ Windows Server 2016 Version-

Microsoft ≫ .Net Framework Version4.6

   Microsoft ≫ Windows 7 Version- Updatesp1
   Microsoft ≫ Windows 8.1 Version-
   Microsoft ≫ Windows Rt 8.1 Version-
   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2

Microsoft ≫ .Net Framework Version4.6.1

   Microsoft ≫ Windows 7 Version- Updatesp1
   Microsoft ≫ Windows 8.1 Version-
   Microsoft ≫ Windows Rt 8.1 Version-
   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2

Microsoft ≫ .Net Framework Version4.6.2

   Microsoft ≫ Windows 7 Version- Updatesp1
   Microsoft ≫ Windows 8.1 Version-
   Microsoft ≫ Windows Rt 8.1 Version-
   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2

Microsoft ≫ .Net Framework Version4.7

   Microsoft ≫ Windows 7 Version- Updatesp1
   Microsoft ≫ Windows 8.1 Version-
   Microsoft ≫ Windows Rt 8.1 Version-
   Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
   Microsoft ≫ Windows Server 2012 Version-
   Microsoft ≫ Windows Server 2012 Versionr2

Microsoft ≫ .Net Framework Version4.7

Microsoft ≫ Windows 10 Version1703

Microsoft ≫ .Net Framework Version4.7.1

Microsoft ≫ Windows 10 Version1709

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.55%	0.808

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:P/A:N

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

http://www.securitytracker.com/id/1040152

Third Party Advisory

VDB Entry

http://www.securityfocus.com/bid/102380

Third Party Advisory

VDB Entry

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0786

Patch

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2018-0786

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-0786

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-0786

EUVD