Lucene search

Kaspersky LabKLA11248

HistoryMay 08, 2018 - 12:00 a.m.

KLA11248 Multiple vulnerabilities in Microsoft Developer Tools

2018-05-0800:00:00

Kaspersky Lab

threats.kaspersky.com

217

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

High

EPSS

0.004

Percentile

72.0%

JSON

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to spoof user interface, bypass security restrictions, cause denial of service.

Below is a complete list of vulnerabilities:

A spoofing vulnerability in Azure IoT SDK can be exploited remotely to spoof user interface.
A security feature bypass vulnerability in .NET Framework Device Guard can be exploited remotely to bypass security restrictions.
A denial of service vulnerability in .NET and .NET Core can be exploited remotely via specially crafted requests to cause denial of service.

Original advisories

CVE-2018-8119

CVE-2018-1039

CVE-2018-0765

Related products

Microsoft-.NET-Framework

Microsoft-Azure

CVE list

CVE-2018-0765 warning

CVE-2018-1039 warning

CVE-2018-8119 high

KB list

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

Microsoft .NET Framework 4.7.2.NET Core 2.0Microsoft .NET Framework 2.0 Service Pack 2Microsoft .NET Framework 3.0 Service Pack 2Microsoft .NET Framework 3.5Microsoft .NET Framework 3.5.1Microsoft .NET Framework 4.5.2Microsoft .NET Framework 4.6Microsoft .NET Framework 4.7.1C# SDK for Azure IoTMicrosoft .NET Framework 4.6.2/4.7/4.7.1Microsoft .NET Framework 4.6/4.6.1/4.6.2Java SDK for Azure IoTMicrosoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1Microsoft .NET Framework 4.7/4.7.1C SDK for Azure IoT