Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA11399
HistoryJan 08, 2019 - 12:00 a.m.

KLA11399 Multiple vulnerabilities in Microsoft Developer Tools

2019-01-0800:00:00
Kaspersky Lab
threats.kaspersky.com
813

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.9 High

AI Score

Confidence

High

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.018 Low

EPSS

Percentile

87.8%

JSON

Detect date:

01/08/2019

Severity:

High

Description:

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to obtain sensitive information, execute arbitrary code, cause denial of service.

Affected products:

Microsoft Visual Studio 2012 Update 5
Microsoft Visual Studio 2010 Service Pack 1
ASP.NET Core 2.1
ASP.NET Core 2.2
Microsoft .NET Framework 3.5.1
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2
Microsoft .NET Framework 3.5
Microsoft .NET Framework 4.7/4.7.1/4.7.2
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 4.7.1/4.7.2
Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2
Microsoft .NET Framework 4.7.2
.NET Core 2.2
Microsoft .NET Framework 4.6/4.6.1/4.6.2
Microsoft .NET Framework 4.5.2
.NET Core 2.1
Microsoft .NET Framework 4.6
PowerShell Core 6.2
PowerShell Core 6.1
Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2019-0537
CVE-2019-0546
CVE-2019-0548
CVE-2019-0564
CVE-2019-0545

Impacts:

ACE

Related products:

Microsoft .NET Framework

CVE-IDS:

CVE-2019-05374.3Warning
CVE-2019-05469.3Critical
CVE-2019-05485.0Warning
CVE-2019-05645.0Warning
CVE-2019-05455.0Warning

KB list:

4480978
4480962
4480966
4480961
4480973
4476698
4476755
4480056
4481480
4481481
4481482
4481483
4481484
4481485
4481486
4481487

Microsoft official advisories:

References

Related

redhat 1
nessus 16
github 2
cvelist 5
redhatcve 3
osv 5
prion 5
cve 5
symantec 5
checkpoint_advisories 1
openvas 14
zdi 2
mskb 17
veracode 4
mscve 5
talosblog 1
redhat
redhat
(RHSA-2019:0040) Moderate: .NET Core on Red Hat Enterprise Linux security update
2019-01-09 08:33:36
nessus
nessus
RHEL 7 : .NET Core on Red Hat Enterprise Linux (RHSA-2019:0040)
2019-01-14 00:00:00
Security Updates for Microsoft Visual Studio Products (January 2019)
2019-01-10 00:00:00
Security Update for Microsoft ASP.NET Core (DoS) (January 2019)
2019-03-27 00:00:00
github
github
Denial of service in ASP.NET Core
2022-05-14 01:41:32
Exposure of Sensitive Information in System.Net.Http
2022-05-14 01:41:10
cvelist
cvelist
CVE-2019-0564
2019-01-08 21:00:00
CVE-2019-0548
2019-01-08 21:00:00
CVE-2019-0537
2019-01-08 21:00:00
redhatcve
redhatcve
CVE-2019-0548
2019-01-08 21:20:16
CVE-2019-0564
2019-10-10 23:37:43
CVE-2019-0545
2019-01-08 21:20:57
osv
osv
CVE-2019-0564
2019-01-08 21:29:01
Denial of service in ASP.NET Core
2022-05-14 01:41:32
CVE-2019-0548
2019-01-08 21:29:00
prion
prion
Denial of service
2019-01-08 21:29:00
Denial of service
2019-01-08 21:29:00
Information disclosure
2019-01-08 21:29:00
cve
cve
CVE-2019-0548
2019-01-08 21:29:00
CVE-2019-0564
2019-01-08 21:29:00
CVE-2019-0546
2019-01-08 21:29:00
symantec
symantec
Microsoft Visual Studio CVE-2019-0537 Information Disclosure Vulnerability
2019-01-08 00:00:00
Microsoft ASP.NET CVE-2019-0564 Denial Of Service Vulnerability
2019-01-08 00:00:00
Microsoft Visual Studio CVE-2019-0546 Remote Code Execution Vulnerability
2019-01-08 00:00:00
checkpoint_advisories
checkpoint_advisories
Microsoft Visual Studio Vscontent Information Disclosure (CVE-2019-0537)
2019-09-23 00:00:00
openvas
openvas
Microsoft Visual Studio Multiple Information Disclosure Vulnerabilities (KB4476698, KB4476755)
2019-01-14 00:00:00
Microsoft .NET Framework Information Disclosure Vulnerability (KB4480063)
2019-01-09 00:00:00
Microsoft .NET Framework Information Disclosure Vulnerability (KB4480054)
2019-01-09 00:00:00
zdi
zdi
Microsoft Visual Studio vscontent XML External Entity Processing Information Disclosure Vulnerability
2019-01-10 00:00:00
Microsoft Visual Studio asm Memory Corruption Remote Code Execution Vulnerability
2019-01-10 00:00:00
mskb
mskb
Description of the security update for the information disclosure vulnerability in Visual Studio 2012 Update 5: January 8, 2019
2019-01-08 08:00:00
Security Only updates for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, and 4.7.2 for Windows Server 2012 (KB 4481483)
2019-01-08 08:00:00
Security Only updates for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, and 4.7.2 for Windows 7 SP1 and Server 2008 R2 SP1 (KB 4481481)
2019-01-08 08:00:00
veracode
veracode
Cross-Origin Resource Sharing (CORS) Bypass
2019-01-15 09:27:08
Cross-Origin Resource Sharing (CORS) Bypass
2019-01-09 02:50:50
Denial Of Service (DoS)
2019-01-09 04:51:13
mscve
mscve
Visual Studio Remote Code Execution Vulnerability
2019-01-08 08:00:00
Microsoft Visual Studio Information Disclosure Vulnerability
2019-01-08 08:00:00
ASP.NET Core Denial of Service Vulnerability
2019-01-08 08:00:00
talosblog
talosblog
Microsoft Patch Tuesday — January 2019: Vulnerability disclosures and Snort coverage
2019-01-08 11:40:00

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.9 High

AI Score

Confidence

High

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.018 Low

EPSS

Percentile

87.8%

JSON
Related for KLA11399
redhat1nessus16github2cvelist5redhatcve3osv5prion5cve5symantec5checkpoint_advisories1openvas14zdi2mskb17veracode4mscve5talosblog1