Stay Secure with the Latest Linux Advisories

security advisoryupdate instructionsubuntu

Ubuntu 23.04: USN-6217-1 Critical Dotnet Account Bypass Threat

The maximum failed attempts security feature for .NET could be bypassed.. =========================================================================Ubuntu Security Notice USN-6217-1 July 11, 2023 dotnet6, dotnet7 vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.04 - Ubuntu 22.10 - Ubuntu 22.04 LTS Summary: The maximum failed attempts security feature for .NET could be bypassed. Software Description: - dotnet6: dotNET CLI tools and runtime - dotnet7: dotNET CLI tools and runtime Details: McKee-Harris, Matt Cotterell, and Jack Moran discovered that .NET did not properly update account lockout maximum failed attempts. An attacker could possibly use this issue to bypass the security feature and attempt to guess more passwords for an account. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.04: aspnetcore-runtime-6.0 6.0.120-0ubuntu1~23.04.1 aspnetcore-runtime-7.0 7.0.109-0ubuntu1~23.04.1 dotnet-host 6.0.120-0ubuntu1~23.04.1 dotnet-host-7.0 7.0.109-0ubuntu1~23.04.1 dotnet-hostfxr-6.0 6.0.120-0ubuntu1~23.04.1 dotnet-hostfxr-7.0 7.0.109-0ubuntu1~23.04.1 dotnet-runtime-6.0 6.0.120-0ubuntu1~23.04.1 dotnet-runtime-7.0 7.0.109-0ubuntu1~23.04.1 dotnet-sdk-6.0 6.0.120-0ubuntu1~23.04.1 dotnet-sdk-7.0 7.0.109-0ubuntu1~23.04.1 dotnet6 6.0.120-0ubuntu1~23.04.1 dotnet7 7.0.109-0ubuntu1~23.04.1 Ubuntu 22.10: aspnetcore-runtime-6.0 6.0.120-0ubuntu1~22.10.1 aspnetcore-runtime-7.0 7.0.109-0ubuntu1~22.10.1 dotnet-host 6.0.120-0ubuntu1~22.10.1 dotnet-host-7.0 7.0.109-0ubuntu1~22.10.1 dotnet-hostfxr-6.0 6.0.120-0ubuntu1~22.10.1 dotnet-hostfxr-7.0 7.0.109-0ubuntu1~22.10.1 dotnet-runtime-6.0 6.0.120-0ubuntu1~22.10.1 dotnet-runtime-7.0 7.0.109-0ubuntu1~22.10.1 dotnet-sdk-6.0 6.0.120-0ubuntu1~22.10.1 dotnet-sdk-7.0 7.0.109-0ubuntu1~22.10.1 dotnet6 6.0.120-0ubuntu1~22.10.1 dotnet7 7.0.109-0ubuntu1~22.10.1 Ubuntu 22.04 LTS: aspnetcore-runtime-6.0 6.0.120-0ubuntu1~22.04.1 aspnetcore-runtime-7.0 7.0.109-0ubuntu1~22.04.1 dotnet-host 6.0.120-0ubuntu1~22.04.1 dotnet-host-7.0 7.0.109-0ubuntu1~22.04.1 dotnet-hostfxr-6.0 6.0.120-0ubuntu1~22.04.1 dotnet-hostfxr-7.0 7.0.109-0ubuntu1~22.04.1 dotnet-runtime-6.0 6.0.120-0ubuntu1~22.04.1 dotnet-runtime-7.0 7.0.109-0ubuntu1~22.04.1 dotnet-sdk-6.0 6.0.120-0ubuntu1~22.04.1 dotnet-sdk-7.0 7.0.109-0ubuntu1~22.04.1 dotnet6 6.0.120-0ubuntu1~22.04.1 dotnet7 7.0.109-0ubuntu1~22.04.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6217-1 CVE-2023-33170 Package Information: https://launchpad.net/ubuntu/+source/dotnet6/6.0.120-0ubuntu1~23.04.1 https://launchpad.net/ubuntu/+source/dotnet7/7.0.109-0ubuntu1~23.04.1 https://launchpad.net/ubuntu/+source/dotnet6/6.0.120-0ubuntu1~22.10.1 https://launchpad.net/ubuntu/+source/dotnet7/7.0.109-0ubuntu1~22.10.1 https://launchpad.net/ubuntu/+source/dotnet6/6.0.120-0ubuntu1~22.04.1 https://launchpad.net/ubuntu/+source/dotnet7/7.0.109-0ubuntu1~22.04.1 . Enhance your Ubuntu installation by updating it to address security vulnerabilities in dotnet6 and dotnet7 concerning the circumvention of maximum failed login attempts.. Dotnet Security, Ubuntu Update, Account Protection. . Severity: Critical. LinuxSecurity.com Team

Jul 11, 2023 •Critical Ubuntu