KLA12073 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, cause denial of service.

Below is a complete list of vulnerabilities:

1. A remote code execution vulnerability in .NET Core can be exploited remotely to execute arbitrary code.
2. A remote code execution vulnerability in Visual Studio Code can be exploited remotely to execute arbitrary code.
3. An elevation of privilege vulnerability in Sysinternals PsExec can be exploited remotely to gain privileges.
4. A denial of service vulnerability in .NET Core and Visual Studio can be exploited remotely to cause denial of service.
5. A remote code execution vulnerability in Package Managers Configurations can be exploited remotely to execute arbitrary code.
6. A remote code execution vulnerability in Visual Studio Code npm-script Extension can be exploited remotely to execute arbitrary code.
7. A denial of service vulnerability in .NET Framework can be exploited remotely to cause denial of service.

Original advisories

CVE-2021-26701

CVE-2021-1639

CVE-2021-1733

CVE-2021-1721

CVE-2021-24105

CVE-2021-26700

CVE-2021-24111

CVE-2021-24112

Exploitation

Public exploits exist for this vulnerability.

Related products

Microsoft-.NET-Framework

Microsoft-Visual-Studio

Microsoft-PsExec

CVE list

CVE-2021-26701 critical

CVE-2021-1639 high

CVE-2021-1733 critical

CVE-2021-1721 high

CVE-2021-24105 critical

CVE-2021-26700 critical

CVE-2021-24111 critical

CVE-2021-24112 critical

KB list

4601354

4601318

4602960

4601056

4603002

4601050

4603004

4602961

4602959

4603003

4601051

4601887

4601054

4602958

4603005

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• .NET Core 2.1Microsoft Visual Studio 2019 version 16.8Visual Studio CodeMicrosoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)Microsoft .NET Framework 4.7.2.NET Core 3.1Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)Visual Studio Code - npm-script ExtensionMicrosoft .NET Framework 4.6.NET 5.0PsExecPackage Manager ConfigurationsMicrosoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2Microsoft .NET Framework 4.8Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2