KLA11971 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to obtain sensitive information, bypass security restrictions, execute arbitrary code.

Below is a complete list of vulnerabilities:

1. An information disclosure vulnerability in .NET Framework can be exploited remotely via specially crafted application to obtain sensitive information.
2. A security feature bypass vulnerability in PowerShellGet Module WDAC can be exploited remotely to bypass security restrictions.
3. A remote code execution vulnerability in Visual Studio Code Python Extension can be exploited remotely via specially crafted file to execute arbitrary code.

Original advisories

CVE-2020-16937

CVE-2020-16886

CVE-2020-16977

Related products

Microsoft-.NET-Framework

Microsoft-Visual-Studio

CVE list

CVE-2020-16937 warning

CVE-2020-16886 high

CVE-2020-16977 high

KB list

4579980

4578974

4578972

4578971

4579977

4579978

4579979

4578968

4578969

4580328

4579976

4580330

4580327

4580346

4580470

4580468

4580469

4580467

4578961

4578963

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• Visual Studio CodeMicrosoft .NET Framework 3.5 AND 4.8Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2Microsoft .NET Framework 3.5.1Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2Microsoft .NET Framework 4.5.2Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2Microsoft .NET Framework 3.5Microsoft .NET Framework 4.8Microsoft .NET Framework 4.6Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2Microsoft .NET Framework 3.5 AND 4.7.2PowerShellGet 2.2.5Microsoft .NET Framework 2.0 Service Pack 2