KLA11172 Multiple vulnerabilities in Microsoft Development Tools

Multiple serious vulnerabilities have been found in Microsoft .NET Core, ASP.NET Core, Microsoft Excel and Microsoft Office Compatibility Pack. Malicious users can exploit these vulnerabilities to spoof user interface, obtain sensitive information, bypass security restrictions and gain privileges.

1. A remote code execution vulnerability can be exploited remotely via specially crafted file to execute arbitrary code;
2. An elevation of privilege vulnerability can be exploited remotely via specially crafted email with malicious link to gain privileges;
3. A Cross Site Request Forgery vulnerability can be exploited remotely via changing of recovery code for victim’s account to spoof user interface;
4. A security feature bypass vulnerability can be exploited remotely via using specially marked certificate to bypass security restrictions;

Technical details

Vulnerability (1) is related to Microsoft Excel and Microsoft Office Compatibility Pack. Vulnerabilities (2) and (3) are related to ASP.NET Core. Vulnerability (4) is related to .NET Core and Microsoft .NET Framework.

Original advisories

CVE-2018-0784

CVE-2018-0785

CVE-2018-0786

CVE-2018-0764

Related products

Microsoft-.NET-Framework

Microsoft-Office-Compatibility-Pack-for-Word,-Excel,-and-PowerPoint-2007-File-Formats

Microsoft-Excel

Microsoft-ASP.NET-MVC

CVE list

CVE-2018-0784 high

CVE-2018-0785 warning

CVE-2018-0786 warning

CVE-2018-0764 warning

KB list

4056888

4056890

4056893

4056891

4056892

4054176

4054177

4054174

4054175

4054172

4054995

4054170

4054171

4054998

4054999

4054181

4054997

4054996

4054993

4055001

4055000

4055002

4054994

4054182

4054183

4074880

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Microsoft .NET Framework 4.7.1