---
title: Security Bulletin NR17-04
source: https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr17-04
---

## Summary

A security update for New Relic's .NET agent fixes a vulnerability where the agent could unintentionally capture service request parameters from WCF applications.

**Release date:** May 4, 2017

**Vulnerability identifier:** NR17-04

**Priority:** Medium

## Affected software [#affected]

The following New Relic agent versions are affected:

| **Name**   | **Affected version**    | **Notes** | **Remediated version**                                                                           |
| ---------- | ----------------------- | --------- | ------------------------------------------------------------------------------------------------ |
| .NET agent | 6.8.172.0 (and greater) | With WCF  | [6.11.613.0](https://docs.newrelic.com/docs/release-notes/agent-release-notes/net-release-notes) |

## Vulnerability information [#vuln-info]

New Relic’s .NET Agent version **6.8.172.0** added visibility into Error Analytics. By default the agent will capture error events, and with WCF applications this is captured as event type **TransactionError**. New Relic has found that the \*\*service.request.\*\*\* attributes may contain sensitive information that should not be sent to New Relic. A fix has been made to disable the collection of these parameters during the error collection. Customers are encouraged to upgrade to the latest version of the .NET agent.

### Mitigating factors [#factors]

-   Only .NET agents with Error Analytics and WCF applications are affected.
-   All service request attributes are disabled in High-security mode.

## Workarounds

Users who are affected and unable to upgrade may choose to manually configure the .NET agent to not capture service request parameters. Users can exclude \*\*service.request.\*\*\* attributes from the **errorCollector** stanza in their newrelic.config file.

```
<attributes enabled="true">
     <exclude > service.request.*</exclude>
 </attributes>
```

For details please refer to our [.NET agent Error Collector configuration](https://docs.newrelic.com/docs/agents/net-agent/installation-configuration/net-agent-configuration#error_collector)

## Report security vulnerabilities to New Relic [#report]

New Relic is committed to the security of our customers and their data. If you believe you have found a security vulnerability in one of our products or websites, we welcome and greatly appreciate you reporting it to New Relic's coordinated disclosure program. For more information, see [Reporting security vulnerabilities](https://docs.newrelic.com/docs/security/new-relic-security/data-privacy/reporting-security-vulnerabilities).

## For more help [#more_help]

Additional documentation resources include:.

-   [Upgrade the .NET agent](https://docs.newrelic.com/docs/agents/net-agent/installation-configuration/upgrade-net-agent)
-   [.NET agent Error Collector configuration](https://docs.newrelic.com/docs/agents/net-agent/installation-configuration/net-agent-configuration#error_collector)
-   [MSDN: Windows Communication Foundation](https://msdn.microsoft.com/en-us/library/dd456779(v=vs.110).aspx)
-   [NR Security](https://newrelic.com/security)