KLA11419 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, spoof user interface, obtain sensitive information, gain privileges.

Below is a complete list of vulnerabilities:

1. A security feature bypass vulnerability in Windows can be exploited remotely to bypass security restrictions.
2. A remote code execution vulnerability in .NET Framework and Visual Studio can be exploited remotely via specially crafted file to execute arbitrary code.
3. A spoofing vulnerability in .NET Framework and Visual Studio can be exploited remotely to spoof user interface.
4. A cross-site-scripting (XSS) vulnerability Team Foundation Server can be exploited remotely via specially crafted payload to spoof user interface.
5. An information disclosure vulnerability in Azure IoT Java SDK can be exploited remotely to obtain sensitive information.
6. An elevation of privilege vulnerability in Azure IoT Java SDK can be exploited remotely to gain privileges.
7. A remote code execution vulnerability in Visual Studio Code can be exploited remotely to execute arbitrary code.

Original advisories

CVE-2019-0631

CVE-2019-0613

CVE-2019-0657

CVE-2019-0742

CVE-2019-0632

CVE-2019-0741

CVE-2019-0627

CVE-2019-0729

CVE-2019-0728

CVE-2019-0743

Related products

Microsoft-.NET-Framework

Microsoft-Visual-Studio

Microsoft-Windows

Microsoft-Windows-Server

Microsoft-Windows-10

Team-Foundation-Server

Microsoft-Azure

CVE list

CVE-2019-0627 warning

CVE-2019-0631 warning

CVE-2019-0632 warning

CVE-2019-0741 warning

CVE-2019-0743 warning

CVE-2019-0613 critical

CVE-2019-0742 warning

CVE-2019-0728 critical

CVE-2019-0657 warning

CVE-2019-0729 critical

KB list

4487020

4487017

4486996

4487026

4487018

4483452

4483450

4487081

4487079

4487078

4487124

4487121

4487123

4487122

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• .NET Core 1.0.NET Core 2.1.NET Core 2.2Java SDK for Azure IoTMicrosoft .NET Framework 2.0 Service Pack 2Microsoft .NET Framework 3.0 Service Pack 2Microsoft .NET Framework 3.5Microsoft .NET Framework 3.5.1Microsoft .NET Framework 4.5.2Microsoft .NET Framework 4.6Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2Microsoft .NET Framework 4.6/4.6.1/4.6.2Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2Microsoft .NET Framework 4.7.1/4.7.2Microsoft .NET Framework 4.7.2Microsoft .NET Framework 4.7/4.7.1/4.7.2Microsoft Visual Studio 2017Team Foundation Server 2018 Update 3.2Visual Studio CodeWindows 10 for 32-bit SystemsWindows Server, version 1803 (Server Core Installation)PowerShell Core 6.2Windows 10 for x64-based SystemsWindows Server 2016 (Server Core installation)Windows 10 Version 1803 for ARM64-based SystemsWindows Server 2016Windows 10 Version 1709 for x64-based SystemsWindows 10 Version 1709 for ARM64-based SystemsWindows 10 Version 1703 for x64-based SystemsWindows 10 Version 1809 for 32-bit SystemsWindows 10 Version 1809 for ARM64-based SystemsWindows Server 2019 (Server Core installation)PowerShell Core 6.1Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)Windows 10 Version 1803 for x64-based SystemsWindows 10 Version 1607 for 32-bit SystemsWindows Server, version 1709 (Server Core Installation)Windows 10 Version 1809 for x64-based SystemsWindows 10 Version 1607 for x64-based SystemsWindows 10 Version 1803 for 32-bit SystemsWindows 10 Version 1709 for 32-bit SystemsWindows 10 Version 1703 for 32-bit SystemsWindows Server 2019