Microsoft Security Advisory CVE-2017-11770 : Malformed Certificate can cause Denial of Service

[blowdart]

Microsoft Security Advisory CVE-2017-11770

Malformed Certificate can cause Denial of Service

Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the public versions of .NET Core 1.0 and 1.1, and 2.0. This advisory also provides guidance on what developers can do to update their applications correctly.

Microsoft is aware of a security vulnerability in the public version of .NET Core where a malformed certificate or other ASN.1 formatted data could lead to a denial of service via an infinite loop on Linux and macOS.

System administrators are advised to update their .NET Core runtimes to versions 1.0.8, 1.1.5 and 2.0.3. Developers are advised to update their .NET Core SDK to version 2.0.3 or 1.1.5.

Discussion

Please use dotnet/corefx#25245 for discussion of this advisory.

Mitigation Factors

.NET Core applications running on Windows are not affected by this vulnerability.

Affected Software

The vulnerabilities affect any Microsoft .NET Core project if it uses any of affected runtime versions listed below and is running on Linux.

Platform	Runtime Version	Fixed runtime version
Linux	1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.7 1.1.0, 1.1.1, 1.1.2, 1.1.4 2.0.0	1.0.8 1.1.5 2.0.3
macOS	1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.7 1.1.0, 1.1.1, 1.1.2, 1.1.4	1.0.8 1.1.5

Advisory FAQ

How do I know if I am affected?

Any application running against .NET Core 1.0.7 or lower, or 1.1.2 or lower, or 2.0.0 is affected. The default version of the .NET core runtime can be listed by running dotnet --info, which should produce output in the form of

.NET Command Line Tools (2.0.2)

Product Information:
 Version:            2.0.2
 Commit SHA-1 hash:  a04b4bf512

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.16299
 OS Platform: Windows
 RID:         win10-x64
 Base Path:   C:\Program Files\dotnet\sdk\2.0.2\

Microsoft .NET Core Shared Framework Host

  Version  : 2.0.0
  Build    : e8b8861ac7faf042c87a5c2f9f2d04c98b69f28d

As this only displays the latest version of the runtime installed it may hide the fact that you have a vulnerable runtime. A complete list of runtimes can be discovered by performing a directory listing in the install root directories. By default these are

Operating System	Location
macOS	/usr/local/share/dotnet/shared/Microsoft.NETCore.App/
Supported Linux platforms	/usr/share/dotnet/shared/Microsoft.NETCore.App/

Each runtime version is installed in its own directory, where the directory name is the version number. If you do not have a directory for 1.0.8, 1.1.5 or 2.0.3 then any applications targeting .NET Core will be vulnerable.

How do I fix my affected application?

Applications can be fixed by installing the latest runtimes or SDKs. Typically application servers only install a runtime package, developer machines install SDKs. Installers for the runtimes can be downloaded from the Runtime and SDK download archive. Version 1.1.5 will also install version 1.0.8 of the runtime.

If you have built a self-contained application you must install the new runtime and SDK, recompile your application and redeploy.

Other Information

Reporting Security Issues

If you have found a potential security issue in .NET Core, please email details to secure@microsoft.com. Reports may qualify for the .NET Core Bug Bounty. Details of the .NET Core Bug Bounty including Terms and Conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET Core or ASP.NET Core organizations. These are located at https://github.com/dotnet/ and https://github.com/aspnet/. The Announcements repo for each product (https://github.com/dotnet/Announcements and https://github.com/aspnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.

What if the update breaks my application?

An application can be pinned to a previous version of the runtime by editing the application.runtime.config file for that application and editing the framework version and setting rollForward to false. This should be treated as a temporary measure and the application updated to work with the patched versions of the framework.

Note that this file is optional, you may need to create it for each application alongside the executable.

Acknowledgments

Thanks to Bachraty Gergely for reporting this issue.

External Links

CVE-2017-11770

Revisions

V1.0 (Nov 14, 2017): Advisory published.
V1.1 (Nov 14, 2017): Link to CVE corrected.
V1.2 (Nov 14, 2017): Version numbers updated to reflect the correct version, 2.0.3

Version 1.2
Last Updated 2017-11-15