Microsoft Mono Framework 5.18.0.223/5.20.0 Package Manager access control

Summaryinfo

A vulnerability was found in Microsoft Mono Framework 5.18.0.223/5.20.0 and classified as critical. Affected by this issue is some unknown functionality of the component Package Manager. Such manipulation leads to access control. This vulnerability is referenced as CVE-2019-0757. It is possible to launch the attack remotely. No exploit is available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in Microsoft Mono Framework 5.18.0.223/5.20.0. It has been rated as critical. Affected by this issue is an unknown code of the component Package Manager. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'.

The bug was discovered 03/12/2019. The weakness was published 03/12/2019 as confirmed security update guide (Website). The advisory is shared for download at portal.msrc.microsoft.com. The public release has been coordinated with the vendor. This vulnerability is handled as CVE-2019-0757 since 11/26/2018. The attack may be launched remotely. A simple authentication is needed for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068. The advisory points out:

A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure. An attacker who successfully exploited this vulnerability could potentially modify files and folders that are unpackaged on a system.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 237251 (Red Hat Update for dotnet (RHSA-2019:1259)).

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Similar entries are available at VDB-131659, VDB-131661 and VDB-131662. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Microsoft

Name

• Mono Framework

Version

• 5.18.0.223
• 5.20.0

License

• commercial

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion