CERT-In Vulnerability Note
CIVN-2020-0052
Multiple Vulnerabilities in Microsoft Visual Studio
Original Issue Date:March 16, 2020
Severity Rating: HIGH
Software Affected
- Microsoft Visual Studio 2019 version 16.0
- Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)
- Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)
- Microsoft Visual Studio 2019 version 16.0
- Microsoft Visual Studio 2015 Update 3
- Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)
- Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)
- Microsoft Visual Studio 2019 version 16.0
- Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)
- Microsoft Visual Studio 2015 Update 3
- Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)
- Microsoft Visual Studio 2019 version 16.0
- Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)
Overview
Multiple vulnerabilities have been reported in Microsoft Visual Studio which could allow remote attacker to execute denial of service attack, elevation of privilege and spoofing on the targeted system.
Description
1. Denial of Service Vulnerability
(
CVE-2020-0789
)
This vulnerability exists in Microsoft Visual Studio due to improper handling of hard links by the Extension Installer Service. A local attacker could exploit this vulnerability by running a specially crafted application on the affected system.
Successful exploitation of this vulnerability could allow the attacker to overwrite system files and cause Denial of Services on targeted system.
2. Elevation of Privilege Vulnerability
(
CVE-2020-0793
CVE-2020-0810
)
This vulnerability exists in Microsoft Visual Studio due to improper handling of file operations by the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector. An unauthenticated attacker could exploit this vulnerability by running a specially-crafted application on the affected system.
Successful exploitation of this vulnerability could allow the attacker to escalate privileges on targeted system.
3. Spoofing Vulnerability
(
CVE-2020-0884
)
This vulnerability exists in Microsoft Visual Studio due to the use of reply URL that is not secured by SSL .An attacker could exploit this vulnerability by persuading a victim to open a specially-crafted content.
Successful exploitation of this vulnerability could allow a remote attacker to spoof access tokens and obtain potentially sensitive information.
Solution
Apply appropriate software fixes as available on the vendor website.
https://portal.msrc.microsoft.com/en-us/security-guidance
Vendor Information
Microsoft
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0789
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0793
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0810
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0884
References
Microsoft
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0789
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0793
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0810
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0884
CVE Name
CVE-2020-0789
CVE-2020-0793
CVE-2020-0810
CVE-2020-0884
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in
Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|