Permissions, Privileges, and Access Controls in Microsoft products - CVE-2023-36049

Vulnerability identifier: #VU83152

CSH Severity: Medium

CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-36049

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in .NET, .NET Framework and Visual Studio, which leads to security restrictions bypass and privilege escalation.

Microsoft .NET Framework
.NET
Robotic Process Automation for Cloud Pak
Visual Studio
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat Enterprise Linux for Power, little endian
Ubuntu
TeleControl Server Basic
dotnet-apphost-pack-6.0
aspnetcore-targeting-pack-6.0
aspnetcore-runtime-6.0
dotnet-targeting-pack-6.0
dotnet-host
dotnet-hostfxr-6.0
dotnet-runtime-6.0
dotnet-host (Ubuntu package)
dotnet-hostfxr-6.0 (Ubuntu package)
dotnet-runtime-6.0 (Ubuntu package)
dotnet-sdk-6.0 (Ubuntu package)
dotnet6 (Ubuntu package)
aspnetcore-runtime-6.0 (Ubuntu package)
dotnet6.0
rh-dotnet60-dotnet (Red Hat package)
dotnet6.0 (Red Hat package)
dotnet-sdk-6.0
dotnet-sdk-6.0-source-built-artifacts
dotnet-templates-6.0
netstandard-targeting-pack-2.1
dotnet
dotnet-sdk-7.0 (Ubuntu package)
dotnet7 (Ubuntu package)
aspnetcore-runtime-7.0 (Ubuntu package)
dotnet-host-7.0 (Ubuntu package)
dotnet-hostfxr-7.0 (Ubuntu package)
dotnet-runtime-7.0 (Ubuntu package)
dotnet7.0 (Red Hat package)
dotnet-hostfxr-8.0 (Ubuntu package)
dotnet-runtime-8.0 (Ubuntu package)
dotnet-host-8.0 (Ubuntu package)
aspnetcore-runtime-8.0 (Ubuntu package)
dotnet-sdk-8.0 (Ubuntu package)
dotnet8.0 (Red Hat package)
dotnet8 (Ubuntu package)

Install updates from vendor's website.

TeleControl Server Basic - update to 3.1.2
dotnet-apphost-pack-6.0 - update to 6.0.25-1.0.1
aspnetcore-targeting-pack-6.0 - update to 6.0.25-1.0.1
aspnetcore-runtime-6.0 - update to 6.0.25-1.0.1
dotnet-targeting-pack-6.0 - update to 6.0.25-1.0.1
dotnet-host - update to 6.0.25-1.0.1
dotnet-hostfxr-6.0 - update to 6.0.25-1.0.1
dotnet-runtime-6.0 - update to 6.0.25-1.0.1
dotnet-host (Ubuntu package) - addressed in versions 6.0.125-0ubuntu1~22.04.1, 6.0.125-0ubuntu1~23.04.1, 6.0.125-0ubuntu1~23.10.1
dotnet-hostfxr-6.0 (Ubuntu package) - addressed in versions 6.0.125-0ubuntu1~22.04.1, 6.0.125-0ubuntu1~23.04.1, 6.0.125-0ubuntu1~23.10.1
dotnet-runtime-6.0 (Ubuntu package) - addressed in versions 6.0.125-0ubuntu1~22.04.1, 6.0.125-0ubuntu1~23.04.1, 6.0.125-0ubuntu1~23.10.1
dotnet-sdk-6.0 (Ubuntu package) - addressed in versions 6.0.125-0ubuntu1~22.04.1, 6.0.125-0ubuntu1~23.04.1, 6.0.125-0ubuntu1~23.10.1
dotnet6 (Ubuntu package) - addressed in versions 6.0.125-0ubuntu1~22.04.1, 6.0.125-0ubuntu1~23.04.1, 6.0.125-0ubuntu1~23.10.1
aspnetcore-runtime-6.0 (Ubuntu package) - addressed in versions 6.0.125-0ubuntu1~22.04.1, 6.0.125-0ubuntu1~23.04.1, 6.0.125-0ubuntu1~23.10.1
dotnet6.0 - update to 6.0.125-1
rh-dotnet60-dotnet (Red Hat package) - update to 6.0.125-1.el7_9
dotnet6.0 (Red Hat package) - addressed in versions 6.0.125-1.el8_9, 6.0.125-1.el9_3
dotnet-sdk-6.0 - update to 6.0.125-1.0.1
dotnet-sdk-6.0-source-built-artifacts - update to 6.0.125-1.0.1
dotnet-templates-6.0 - update to 6.0.125-1.0.1
netstandard-targeting-pack-2.1 - update to 6.0.125-1.0.1
dotnet - update to 6.0.125-1.0.1
dotnet-sdk-7.0 (Ubuntu package) - addressed in versions 7.0.114-0ubuntu1~22.04.1, 7.0.114-0ubuntu1~23.04.1, 7.0.114-0ubuntu1~23.10.1
dotnet7 (Ubuntu package) - addressed in versions 7.0.114-0ubuntu1~22.04.1, 7.0.114-0ubuntu1~23.04.1, 7.0.114-0ubuntu1~23.10.1
aspnetcore-runtime-7.0 (Ubuntu package) - addressed in versions 7.0.114-0ubuntu1~22.04.1, 7.0.114-0ubuntu1~23.04.1, 7.0.114-0ubuntu1~23.10.1
dotnet-host-7.0 (Ubuntu package) - addressed in versions 7.0.114-0ubuntu1~22.04.1, 7.0.114-0ubuntu1~23.04.1, 7.0.114-0ubuntu1~23.10.1
dotnet-hostfxr-7.0 (Ubuntu package) - addressed in versions 7.0.114-0ubuntu1~22.04.1, 7.0.114-0ubuntu1~23.04.1, 7.0.114-0ubuntu1~23.10.1
dotnet-runtime-7.0 (Ubuntu package) - addressed in versions 7.0.114-0ubuntu1~22.04.1, 7.0.114-0ubuntu1~23.04.1, 7.0.114-0ubuntu1~23.10.1
dotnet7.0 (Red Hat package) - addressed in versions 7.0.114-1.el8_9, 7.0.114-1.el9_3
dotnet-hostfxr-8.0 (Ubuntu package) - update to 8.0.0-0ubuntu1~23.10.1
dotnet-runtime-8.0 (Ubuntu package) - update to 8.0.0-0ubuntu1~23.10.1
dotnet-host-8.0 (Ubuntu package) - update to 8.0.0-0ubuntu1~23.10.1
aspnetcore-runtime-8.0 (Ubuntu package) - update to 8.0.0-0ubuntu1~23.10.1
dotnet-sdk-8.0 (Ubuntu package) - update to 8.0.100-0ubuntu1~23.10.1
dotnet8.0 (Red Hat package) - addressed in versions 8.0.100-2.el8_9, 8.0.100-2.el9_3
dotnet8 (Ubuntu package) - update to 8.0.100-8.0.0-0ubuntu1~23.10.1
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.13, 23.0.13

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-36049
• https://www.zerodayinitiative.com/advisories/ZDI-23-1639/

• Privilege escalation in Microsoft .NET, .NET Framework and Visual Studio
• Ubuntu update for dotnet6
• Red Hat Enterprise Linux 9 update for dotnet8.0
• Red Hat Enterprise Linux 8 update for dotnet8.0
• Red Hat Enterprise Linux 9 update for dotnet7.0
• Red Hat Enterprise Linux 8 update for dotnet7.0
• Red Hat Enterprise Linux 9 update for dotnet6.0
• Red Hat Enterprise Linux 8 update for dotnet6.0
• Red Hat Enterprise Linux 7 update for .NET 6.0
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in Siemens Telecontrol Server Basic
• Amazon Linux AMI update for dotnet6.0
• Anolis OS update for dotnet6.0