KLA12020 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to spoof user interface, execute arbitrary code, bypass security restrictions.

Below is a complete list of vulnerabilities:

1. A spoofing vulnerability in Azure DevOps Server can be exploited remotely to spoof user interface.
2. A remote code execution vulnerability in Visual Studio can be exploited remotely to execute arbitrary code.
3. A remote code execution vulnerability in Visual Studio Code Remote Development Extension can be exploited remotely to execute arbitrary code.
4. A remote code execution vulnerability in Visual Studio Code Java Extension Pack can be exploited remotely to execute arbitrary code.
5. A spoofing vulnerability in Azure DevOps Server and Team Foundation Services can be exploited remotely to spoof user interface.
6. A security feature bypass vulnerability in Azure SDK for C can be exploited remotely to bypass security restrictions.
7. A remote code execution vulnerability in Visual Studio Code can be exploited remotely to execute arbitrary code.

Original advisories

CVE-2020-17135

CVE-2020-17156

CVE-2020-17148

CVE-2020-17159

CVE-2020-17145

CVE-2020-17002

CVE-2020-17150

Related products

Microsoft-Visual-Studio

Team-Foundation-Server

Microsoft-Azure

CVE list

CVE-2020-17135 high

CVE-2020-17156 critical

CVE-2020-17148 critical

CVE-2020-17159 critical

CVE-2020-17145 high

CVE-2020-17002 high

CVE-2020-17150 critical

KB list

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Visual Studio Code TS-Lint ExtensionMicrosoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)Microsoft Visual Studio 2019 version 16.0Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)Team Foundation Server 2017 Update 3.1Azure DevOps Server 2019 Update 1.1Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)Azure DevOps Server 2020Team Foundation Server 2018 Update 3.2Team Foundation Server 2015 Update 4.2C SDK for Azure IoTTeam Foundation Server 2018 Update 1.2Azure DevOps Server 2019.0.1Microsoft Visual Studio 2019 version 16.8Visual Studio Code Remote - SSH ExtensionVisual Studio Code Language Support for Java Extension