KLA12141 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, obtain sensitive information, spoof user interface.

Below is a complete list of vulnerabilities:

1. An elevation of privilege vulnerability in Diagnostics Hub Standard Collector Service can be exploited remotely to gain privileges.
2. A remote code execution vulnerability in Visual Studio Code GitHub Pull Requests and Issues Extension can be exploited remotely to execute arbitrary code.
3. A remote code execution vulnerability in Visual Studio Code can be exploited remotely to execute arbitrary code.
4. An information disclosure vulnerability in Azure DevOps Server and Team Foundation Server can be exploited remotely to obtain sensitive information.
5. A remote code execution vulnerability in Remote Development Extension for Visual Studio Code can be exploited remotely to execute arbitrary code.
6. A spoofing vulnerability in Azure DevOps Server can be exploited remotely to spoof user interface.
7. A remote code execution vulnerability in Visual Studio Code Maven for Java Extension can be exploited remotely to execute arbitrary code.
8. An elevation of privilege vulnerability in Visual Studio Installer can be exploited remotely to gain privileges.

Original advisories

CVE-2021-28470

CVE-2021-28469

CVE-2021-28321

CVE-2021-27067

CVE-2021-28313

CVE-2021-28473

CVE-2021-28477

CVE-2021-28457

CVE-2021-28475

CVE-2021-28322

CVE-2021-28471

CVE-2021-28459

CVE-2021-28472

CVE-2021-27064

Related products

Microsoft-Visual-Studio

Microsoft-Windows

Microsoft-Windows-Server

Microsoft-Windows-10

Team-Foundation-Server

Microsoft-Azure

CVE list

CVE-2021-28322 critical

CVE-2021-28313 critical

CVE-2021-28321 critical

CVE-2021-28470 critical

CVE-2021-28469 critical

CVE-2021-27067 high

CVE-2021-28473 critical

CVE-2021-28477 high

CVE-2021-28457 critical

CVE-2021-28475 critical

CVE-2021-28471 critical

CVE-2021-28459 high

CVE-2021-28472 critical

CVE-2021-27064 critical

KB list

5001292

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Windows 10 Version 2004 for ARM64-based SystemsWindows 10 Version 1909 for ARM64-based SystemsWindows Server, version 1909 (Server Core installation)Windows 10 Version 2004 for x64-based SystemsAzure DevOps Server 2019 Update 1Team Foundation Server 2017 Update 3.1Azure DevOps Server 2020.0.1Visual Studio CodeMicrosoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)Windows Server 2019Windows 10 Version 1909 for 32-bit SystemsVisual Studio Code - GitHub Pull Requests and Issues ExtensionMicrosoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)Windows 10 Version 1909 for x64-based SystemsMicrosoft Visual Studio 2015 Update 3Windows 10 Version 1809 for ARM64-based SystemsWindows 10 Version 1809 for x64-based SystemsWindows 10 Version 2004 for 32-bit SystemsWindows Server 2019 (Server Core installation)Team Foundation Server 2018 Update 3.2Azure DevOps Server 2019 Update 1.1Windows Server, version 2004 (Server Core installation)Azure DevOps Server 2020Windows 10 Version 20H2 for ARM64-based SystemsAzure DevOps Server 2019.0.1Windows 10 Version 1803 for x64-based SystemsTeam Foundation Server 2015 Update 4.2Windows 10 Version 1803 for 32-bit SystemsVisual Studio Code - Maven for Java ExtensionWindows 10 Version 1809 for 32-bit SystemsWindows Server, version 20H2 (Server Core Installation)Team Foundation Server 2018 Update 1.2Windows 10 Version 20H2 for x64-based SystemsMicrosoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)Windows 10 Version 20H2 for 32-bit SystemsWindows 10 Version 1803 for ARM64-based Systems