var-201807-1618
Vulnerability from variot

A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass Vulnerability." This affects .NET Framework 4.7.2, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, ASP.NET Core 1.1, Microsoft .NET Framework 4.5.2, ASP.NET Core 2.0, ASP.NET Core 1.0, .NET Core 1.1, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 1.0, .NET Core 2.0, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.2. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may aid in further attacks. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

Title: Microsoft Security Update Releases Issued: July 19, 2018

Summary

The following CVEs have undergone a major revision increment:

  • CVE-2018-8202
  • CVE-2018-8260
  • CVE-2018-8284
  • CVE-2018-8356

Revision Information:

  • https://portal.msrc.microsoft.com/en-us/security-guidance
  • Reason for Revision: To address a known issue in the security updates released on July 10, Microsoft is releasing Cumulative Update packages for all supported editions of Windows 10. These packages are available via Microsoft Update catalog, WSUS, or by manually searching Windows Update. Customers who are experiencing issues after installing the July Windows security updates should install the replacement packages as applicable. Please refer to the Affected Products table for the replacement package KB numbers. Customers who have successfully installed the security updates and who are not experiencing any issues do not need to take any action.
  • Originally posted: July 10, 2018
  • Updated: July 19, 2018
  • Aggregate CVE Severity Rating: Important
  • Version: 2.0

The following CVEs have undergone a major revision increment:

  • CVE-2018-0949
  • CVE-2018-8242
  • CVE-2018-8287
  • CVE-2018-8288
  • CVE-2018-8291
  • CVE-2018-8296

Revision Information:

  • https://portal.msrc.microsoft.com/en-us/security-guidance
  • Reason for Revision: To address a known issue in the security updates released on July 10, Microsoft is releasing Cumulative Update packages for Windows 10, and Standalone and Preview Rollup packages for all other supported editions of Windows. These packages are available via Microsoft Update catalog, WSUS, or by manually searching Windows Update. Customers who are experiencing issues after installing the July Windows security updates should install the replacement packages as applicable. Note that the IE Cumulative updates are not affected. Please refer to the Affected Products table for the replacement package KB numbers. Customers who have successfully installed the security updates and who are not experiencing any issues do not need to take any action.
  • Originally posted: July 10, 2018
  • Updated: July 19, 2018
  • Aggregate CVE Severity Rating: Important
  • Version: 2.0

The following CVEs have undergone a major revision increment:

  • CVE-2018-8125 * CVE-2018-8279 * CVE-2018-8301
  • CVE-2018-8206 * CVE-2018-8280 * CVE-2018-8304
  • CVE-2018-8222 * CVE-2018-8282 * CVE-2018-8307
  • CVE-2018-8262 * CVE-2018-8286 * CVE-2018-8308
  • CVE-2018-8274 * CVE-2018-8289 * CVE-2018-8309
  • CVE-2018-8275 * CVE-2018-8290 * CVE-2018-8313
  • CVE-2018-8276 * CVE-2018-8294 * CVE-2018-8314
  • CVE-2018-8278 * CVE-2018-8297 * CVE-2018-8324 * CVE-2018-8325

Revision Information:

  • https://portal.msrc.microsoft.com/en-us/security-guidance
  • Reason for Revision: To address a known issue in the security updates released on July 10, Microsoft is releasing Cumulative Update packages for Windows 10, and Standalone and Preview Rollup packages for all other supported editions of Windows. These packages are available via Microsoft Update catalog, WSUS, or by manually searching Windows Update. Customers who are experiencing issues after installing the July Windows security updates should install the replacement packages as applicable. Please refer to the Affected Products table for the replacement package KB numbers. Customers who have successfully installed the security updates and who are not experiencing any issues do not need to take any action.
  • Originally posted: July 10, 2018
  • Updated: July 19, 2018
  • Aggregate CVE Severity Rating: Critical
  • Version: 2.0

The following CVE has undergone a major revision increment:

  • CVE-2018-8356

Revision Information:

  • https://portal.msrc.microsoft.com/en-us/security-guidance
  • Reason for Revision: Revised the Affected Products table to include PowerShell Core 6.0 and PowerShell Core 6.1 because these products are affected by CVE-2018-9356. See https://github.com/PowerShell/Announcements/issues/6 for more information.
  • Originally posted: July 10, 2018
  • Updated: July 19, 2018
  • Aggregate CVE Severity Rating: Important
  • Version: 3.0

Other Information

Recognize and avoid fraudulent email to Microsoft customers:

If you receive an email message that claims to be distributing a Microsoft security update, it is a hoax that may contain malware or pointers to malicious websites. Microsoft does not distribute security updates via email.

The Microsoft Security Response Center (MSRC) uses PGP to digitally sign all security notifications. However, PGP is not required for reading security notifications, reading security bulletins, or installing security updates. You can obtain the MSRC public PGP key at https://technet.microsoft.com/security/dn753714.

THE INFORMATION PROVIDED IN THIS MICROSOFT COMMUNICATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

Microsoft respects your privacy. Please read our online Privacy Statement at http://go.microsoft.com/fwlink/?LinkId=81184.

If you would prefer not to receive future technical security notification alerts by email from Microsoft and its family of companies please visit the following website to unsubscribe: https://profile.microsoft.com/RegSysProfileCenter/subscriptionwizar d.aspx?wizid=5a2a311b-5189-4c9b-9f1a-d5e913a26c2e&%3blcid=1033.

These settings will not affect any newsletters youave requested or any mandatory service communications that are considered part of certain Microsoft services.

For legal Information, see: http://www.microsoft.com/info/legalinfo/default.mspx.

This newsletter was sent by: Microsoft Corporation 1 Microsoft Way Redmond, Washington, USA 98052 -----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEELe29pj1Ogz+2MnKbEEiO2re18ugFAltRJ4QACgkQEEiO2re1 8uhBGRAAqV/EWkEhrEVrYfOPJe0fzDxFKVu8PespooUpb+/xYFKj0RvyGPBwWkK0 7lGixsk0HDH/VGRevfEPWBUMEDyPp7yudESs7K/Almv0X5Tq9EXa8xsoLOfWmUsF +8OjbFDlsgmJDnsOvrELRAul7bjJDvte3q0jB8QsDIhaMWDOkvKuFfB6M8KwLEJg BeKY/Mudn4BbDxxpMBq72kDCNy6WQar9igbZMS0xu2sDSuTLzqC7qfUg9jseqwhx 5uKJWSKrgCcJ73erJnZRvb1LAglhxD1NGoFdQP36EiIkccOB6kIYv33hpDNd6jf1 S0N8nJVYiUQVqg4ITBtQch5ws6fxXfTIUh7m+oQ4pxvLBbw5QLScub0/AV6ucSaD 9Ace1QwDaOJP+D8aA/+mdmTwr9SvLspNDOm9HkNu10ktRRDyu8PMPf3XGoCAQ1n9 XGtin526zCPy68yFG4BqzN2XSQfft97pwwgcG0KYRV3kB7tbswrtJWOOFbVXvLUl Yd9yvpMql7qfH6p+6f8hS+LG41EEDTqCVEaMT8HTSjld+W36AP2WqlWuSXG9YRBf yhulJ6nF3lbiG1h4pZkY5vrGjvFcfbN4YhSA+FepEolJAnWOtZBg9lswNSuIse3G lvBVHDiKdzpX3ey1qri1czIaC/r46OKW6YuAr4nzhoJKwdfpS34= =b7n1 -----END PGP SIGNATURE-----

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201807-1618",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "microsoft",
        "version": "3.5"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "microsoft",
        "version": "3.5.1"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "microsoft",
        "version": "4.5.2"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "microsoft",
        "version": "4.6"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "microsoft",
        "version": "4.6.1"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "microsoft",
        "version": "4.6.2"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "microsoft",
        "version": "4.7"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "microsoft",
        "version": "4.7.1"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "microsoft",
        "version": "4.7.2"
      },
      {
        "model": ".net core",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "microsoft",
        "version": "1.0"
      },
      {
        "model": ".net core",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "microsoft",
        "version": "1.1"
      },
      {
        "model": ".net core",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "microsoft",
        "version": "2.0"
      },
      {
        "model": ".net framework developer pack",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "microsoft",
        "version": "4.7.2"
      },
      {
        "model": "asp.net core",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "microsoft",
        "version": "1.0"
      },
      {
        "model": "asp.net core",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "microsoft",
        "version": "1.1"
      },
      {
        "model": "asp.net core",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "microsoft",
        "version": "2.0"
      },
      {
        "model": "powershell core",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "microsoft",
        "version": "6.0"
      },
      {
        "model": "powershell core",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "microsoft",
        "version": "6.1"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "microsoft",
        "version": "3.0"
      },
      {
        "model": ".net framework",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "microsoft",
        "version": "3.0 sp2"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007178"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201807-831"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-8356"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:microsoft:.net_core",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:microsoft:.net_framework_developer_pack",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:microsoft:asp.net_core",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:microsoft:.net_framework",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:microsoft:powershell_core",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007178"
      }
    ]
  },
  "cve": "CVE-2018-8356",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2018-8356",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "LOW",
            "trust": 1.8,
            "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 1.8,
            "id": "CVE-2018-8356",
            "impactScore": 3.6,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.8,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2018-8356",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2018-8356",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201807-831",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007178"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201807-831"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-8356"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka \".NET Framework Security Feature Bypass Vulnerability.\" This affects .NET Framework 4.7.2, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, ASP.NET Core 1.1, Microsoft .NET Framework 4.5.2, ASP.NET Core 2.0, ASP.NET Core 1.0, .NET Core 1.1, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 1.0, .NET Core 2.0, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.2. \nAn attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may aid in further attacks. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n********************************************************************\nTitle: Microsoft Security Update Releases\nIssued: July 19, 2018\n********************************************************************\n\nSummary\n=======\n\nThe following CVEs have undergone a major revision increment:\n\n* CVE-2018-8202\n* CVE-2018-8260\n* CVE-2018-8284\n* CVE-2018-8356\n  \nRevision Information:\n=====================\n\n - https://portal.msrc.microsoft.com/en-us/security-guidance\n - Reason for Revision: To address a known issue in the security\n   updates released on July 10, Microsoft is releasing Cumulative\n   Update packages for all supported editions of Windows 10. These\n   packages are available via Microsoft Update catalog, WSUS, or by\n   manually searching Windows Update. Customers who are experiencing\n   issues after installing the July Windows security updates should\n   install the replacement packages as applicable. Please refer to the Affected Products table for the\n   replacement package KB numbers. Customers who have successfully\n   installed the security updates and who are not experiencing any\n   issues do not need to take any action. \n - Originally posted: July 10, 2018\n - Updated: July 19, 2018\n - Aggregate CVE Severity Rating: Important\n - Version: 2.0\n\nThe following CVEs have undergone a major revision increment:\n\n* CVE-2018-0949\n* CVE-2018-8242\n* CVE-2018-8287\n* CVE-2018-8288\n* CVE-2018-8291\n* CVE-2018-8296\n\nRevision Information:\n=====================\n\n - https://portal.msrc.microsoft.com/en-us/security-guidance\n - Reason for Revision: To address a known issue in the security\n   updates released on July 10, Microsoft is releasing Cumulative\n   Update packages for Windows 10, and Standalone and Preview Rollup\n   packages for all other supported editions of Windows. These packages\n   are available via Microsoft Update catalog, WSUS, or by manually\n   searching Windows Update. Customers who are experiencing issues\n   after installing the July Windows security updates should install\n   the replacement packages as applicable. Note that the IE Cumulative\n   updates are not affected. Please refer to the Affected Products\n   table for the replacement package KB numbers. Customers who have\n   successfully installed the security updates and who are not\n   experiencing any issues do not need to take any action. \n - Originally posted: July 10, 2018\n - Updated: July 19, 2018\n - Aggregate CVE Severity Rating: Important\n - Version: 2.0\n\nThe following CVEs have undergone a major revision increment:\n\n* CVE-2018-8125\t* CVE-2018-8279\t* CVE-2018-8301\n* CVE-2018-8206\t* CVE-2018-8280\t* CVE-2018-8304\n* CVE-2018-8222\t* CVE-2018-8282\t* CVE-2018-8307\n* CVE-2018-8262\t* CVE-2018-8286\t* CVE-2018-8308\n* CVE-2018-8274\t* CVE-2018-8289\t* CVE-2018-8309\n* CVE-2018-8275\t* CVE-2018-8290\t* CVE-2018-8313\n* CVE-2018-8276\t* CVE-2018-8294\t* CVE-2018-8314\n* CVE-2018-8278\t* CVE-2018-8297\t* CVE-2018-8324\n\t\t\t\t* CVE-2018-8325\n\nRevision Information:\n=====================\n\n - https://portal.msrc.microsoft.com/en-us/security-guidance\n - Reason for Revision: To address a known issue in the security\n   updates released on July 10, Microsoft is releasing Cumulative\n   Update packages for Windows 10, and Standalone and Preview Rollup\n   packages for all other supported editions of Windows. These\n   packages are available via Microsoft Update catalog, WSUS, or by\n   manually searching Windows Update. Customers who are experiencing\n   issues after installing the July Windows security updates should\n   install the replacement packages as applicable. Please refer to the\n   Affected Products table for the replacement package KB numbers. \n   Customers who have successfully installed the security updates and\n   who are not experiencing any issues do not need to take any action. \n - Originally posted: July 10, 2018\n - Updated: July 19, 2018\n - Aggregate CVE Severity Rating: Critical\n - Version: 2.0\n\n The following CVE has undergone a major revision increment:\n\n* CVE-2018-8356\n\nRevision Information:\n=====================\n\n - https://portal.msrc.microsoft.com/en-us/security-guidance\n - Reason for Revision: Revised the Affected Products table to\n   include PowerShell Core 6.0 and PowerShell Core 6.1 because\n   these products are affected by CVE-2018-9356. See \n   https://github.com/PowerShell/Announcements/issues/6 for \n   more information. \n - Originally posted: July 10, 2018\n - Updated: July 19, 2018\n - Aggregate CVE Severity Rating: Important\n - Version: 3.0\n\nOther Information\n=================\n\nRecognize and avoid fraudulent email to Microsoft customers:\n=============================================================\nIf you receive an email message that claims to be distributing \na Microsoft security update, it is a hoax that may contain \nmalware or pointers to malicious websites. Microsoft does \nnot distribute security updates via email. \n\nThe Microsoft Security Response Center (MSRC) uses PGP to digitally \nsign all security notifications. However, PGP is not required for \nreading security notifications, reading security bulletins, or \ninstalling security updates. You can obtain the MSRC public PGP key\nat \u003chttps://technet.microsoft.com/security/dn753714\u003e. \n\n********************************************************************\nTHE INFORMATION PROVIDED IN THIS MICROSOFT COMMUNICATION IS\nPROVIDED \"AS IS\" WITHOUT WARRANTY OF ANY KIND. MICROSOFT\nDISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING\nTHE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\nPURPOSE. \nIN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE\nLIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,\nINCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL\nDAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN\nADVISED OF THE POSSIBILITY OF SUCH DAMAGES. \nSOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY\nFOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING\nLIMITATION MAY NOT APPLY. \n********************************************************************\n\nMicrosoft respects your privacy. Please read our online Privacy\nStatement at \u003chttp://go.microsoft.com/fwlink/?LinkId=81184\u003e. \n\nIf you would prefer not to receive future technical security\nnotification alerts by email from Microsoft and its family of\ncompanies please visit the following website to unsubscribe:\n\u003chttps://profile.microsoft.com/RegSysProfileCenter/subscriptionwizar\nd.aspx?wizid=5a2a311b-5189-4c9b-9f1a-d5e913a26c2e\u0026%3blcid=1033\u003e. \n\nThese settings will not affect any newsletters youave requested or\nany mandatory service communications that are considered part of\ncertain Microsoft services. \n\nFor legal Information, see:\n\u003chttp://www.microsoft.com/info/legalinfo/default.mspx\u003e. \n\nThis newsletter was sent by:\nMicrosoft Corporation\n1 Microsoft Way\nRedmond, Washington, USA\n98052\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEELe29pj1Ogz+2MnKbEEiO2re18ugFAltRJ4QACgkQEEiO2re1\n8uhBGRAAqV/EWkEhrEVrYfOPJe0fzDxFKVu8PespooUpb+/xYFKj0RvyGPBwWkK0\n7lGixsk0HDH/VGRevfEPWBUMEDyPp7yudESs7K/Almv0X5Tq9EXa8xsoLOfWmUsF\n+8OjbFDlsgmJDnsOvrELRAul7bjJDvte3q0jB8QsDIhaMWDOkvKuFfB6M8KwLEJg\nBeKY/Mudn4BbDxxpMBq72kDCNy6WQar9igbZMS0xu2sDSuTLzqC7qfUg9jseqwhx\n5uKJWSKrgCcJ73erJnZRvb1LAglhxD1NGoFdQP36EiIkccOB6kIYv33hpDNd6jf1\nS0N8nJVYiUQVqg4ITBtQch5ws6fxXfTIUh7m+oQ4pxvLBbw5QLScub0/AV6ucSaD\n9Ace1QwDaOJP+D8aA/+mdmTwr9SvLspNDOm9HkNu10ktRRDyu8PMPf3XGoCAQ1n9\nXGtin526zCPy68yFG4BqzN2XSQfft97pwwgcG0KYRV3kB7tbswrtJWOOFbVXvLUl\nYd9yvpMql7qfH6p+6f8hS+LG41EEDTqCVEaMT8HTSjld+W36AP2WqlWuSXG9YRBf\nyhulJ6nF3lbiG1h4pZkY5vrGjvFcfbN4YhSA+FepEolJAnWOtZBg9lswNSuIse3G\nlvBVHDiKdzpX3ey1qri1czIaC/r46OKW6YuAr4nzhoJKwdfpS34=\n=b7n1\n-----END PGP SIGNATURE-----\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-8356"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007178"
      },
      {
        "db": "BID",
        "id": 104664
      },
      {
        "db": "PACKETSTORM",
        "id": "148630"
      }
    ],
    "trust": 1.98
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-8356",
        "trust": 2.5
      },
      {
        "db": "BID",
        "id": "104664",
        "trust": 1.9
      },
      {
        "db": "SECTRACK",
        "id": "1041257",
        "trust": 1.6
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007178",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201807-831",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "148630",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": 104664
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007178"
      },
      {
        "db": "PACKETSTORM",
        "id": "148630"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201807-831"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-8356"
      }
    ]
  },
  "id": "VAR-201807-1618",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.19172932
  },
  "last_update_date": "2024-11-23T21:52:57.468000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CVE-2018-8356 | .NET Framework Security Feature Bypass Vulnerability",
        "trust": 0.8,
        "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8356"
      },
      {
        "title": "CVE-2018-8356 | .NET Framework \u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u80fd\u306e\u30d0\u30a4\u30d1\u30b9\u306e\u8106\u5f31\u6027",
        "trust": 0.8,
        "url": "https://portal.msrc.microsoft.com/ja-jp/security-guidance/advisory/CVE-2018-8356"
      },
      {
        "title": "Microsoft .NET Framework Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=81895"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007178"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201807-831"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-295",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007178"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-8356"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.6,
        "url": "https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/cve-2018-8356"
      },
      {
        "trust": 1.6,
        "url": "http://www.securitytracker.com/id/1041257"
      },
      {
        "trust": 1.6,
        "url": "http://www.securityfocus.com/bid/104664"
      },
      {
        "trust": 0.9,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-8356"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-8356"
      },
      {
        "trust": 0.8,
        "url": "https://www.ipa.go.jp/security/ciadr/vul/20180711-ms.html"
      },
      {
        "trust": 0.8,
        "url": "http://www.jpcert.or.jp/at/2018/at180028.html"
      },
      {
        "trust": 0.1,
        "url": "http://www.microsoft.com/info/legalinfo/default.mspx\u003e."
      },
      {
        "trust": 0.1,
        "url": "http://go.microsoft.com/fwlink/?linkid=81184\u003e."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-8260"
      },
      {
        "trust": 0.1,
        "url": "https://portal.msrc.microsoft.com/en-us/security-guidance"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-8202"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/powershell/announcements/issues/6"
      },
      {
        "trust": 0.1,
        "url": "https://technet.microsoft.com/security/dn753714\u003e."
      },
      {
        "trust": 0.1,
        "url": "https://profile.microsoft.com/regsysprofilecenter/subscriptionwizar"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-8284"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007178"
      },
      {
        "db": "PACKETSTORM",
        "id": "148630"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201807-831"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-8356"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": 104664
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007178"
      },
      {
        "db": "PACKETSTORM",
        "id": "148630"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201807-831"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-8356"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-09-11T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-007178"
      },
      {
        "date": "2018-07-20T08:22:22",
        "db": "PACKETSTORM",
        "id": "148630"
      },
      {
        "date": "2018-07-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201807-831"
      },
      {
        "date": "2018-07-11T00:29:02.587000",
        "db": "NVD",
        "id": "CVE-2018-8356"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-09-11T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-007178"
      },
      {
        "date": "2022-05-24T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201807-831"
      },
      {
        "date": "2024-11-21T04:13:40.677000",
        "db": "NVD",
        "id": "CVE-2018-8356"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201807-831"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "plural  Microsoft Vulnerabilities that bypass security functions in products",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007178"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "trust management problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201807-831"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.