KLA11812 Multiple vulnerabilities in Microsoft Developer Tools

Detect date:

06/09/2020

Severity:

High

Description:

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to gain privileges, spoof user interface, obtain sensitive information.

Affected products:

Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1803 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows Server 2019 (Server Core installation)
Windows 10 Version 1903 for 32-bit Systems
NuGetGallery
Windows 10 Version 1709 for x64-based Systems
Windows Server, version 1803 (Server Core Installation)
Windows 10 Version 1709 for 32-bit Systems
Windows 10 Version 1803 for 32-bit Systems
Windows 10 Version 1909 for 32-bit Systems
Windows Server 2016 (Server Core installation)
Microsoft Visual Studio Code Live Share extension
Microsoft Visual Studio 2019 version 16.6 (includes 16.0 - 16.5)
Microsoft Visual Studio 2015 Update 3
Windows Server 2019
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 2004 for x64-based Systems
Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)
Windows 10 Version 1903 for x64-based Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows Server, version 2004 (Server Core installation)
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
Windows 10 Version 1607 for 32-bit Systems
Azure DevOps Server 2019 Update 1.1
Azure DevOps Server 2019 Update 1
Windows 10 Version 1803 for ARM64-based Systems
Windows Server, version 1909 (Server Core installation)
Windows 10 Version 1909 for x64-based Systems
Windows 10 for x64-based Systems
Windows 10 Version 1709 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1903 for ARM64-based Systems
Azure DevOps Server 2019.0.1
Windows 10 Version 1909 for ARM64-based Systems
Windows Server 2016
Windows 10 Version 2004 for 32-bit Systems
Microsoft Visual Studio 2019 version 16.0
Windows Server, version 1903 (Server Core installation)

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2020-1202
CVE-2020-1203
CVE-2020-1278
CVE-2020-1293
CVE-2020-1327
CVE-2020-1343
CVE-2020-1257
CVE-2020-1340

Impacts:

OSI

Related products:

Microsoft Visual Studio

CVE-IDS:

CVE-2020-12934.6Warning
CVE-2020-12027.2High
CVE-2020-12037.2High
CVE-2020-12574.6Warning
CVE-2020-12784.6Warning
CVE-2020-13274.3Warning
CVE-2020-13435.0Warning
CVE-2020-13403.5Warning

KB list:

4562053

Microsoft official advisories: