KLA12040 Multiple vulnerability in Microsoft Developer Tools

Detect date:

01/12/2021

Severity:

High

Description:

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, cause denial of service, obtain sensitive information.

Affected products:

Microsoft Visual Studio 2019 version 16.0
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows Server, version 2004 (Server Core installation)
Windows 10 Version 1607 for 32-bit Systems
Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)
Microsoft Visual Studio 2019 version 16.8
Windows 10 Version 1803 for 32-bit Systems
Microsoft Visual Studio 2015 Update 3
Windows 10 Version 1909 for 32-bit Systems
ASP.NET Core 5.0
Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 1803 for x64-based Systems
Windows 10 Version 2004 for 32-bit Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows Server 2019
Windows 10 Version 2004 for x64-based Systems
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
Windows Server, version 1909 (Server Core installation)
Windows Server 2016
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1803 for ARM64-based Systems
Windows Server 2016 (Server Core installation)
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
ASP.NET Core 3.1
Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)
Windows 10 for x64-based Systems
Bot Framework SDK for .NET Framework
Windows Server 2019 (Server Core installation)
Bot Framework SDK for Python
Bot Framework SDK for JavaScript
Windows 10 Version 1909 for x64-based Systems

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2021-1651
CVE-2021-1680
CVE-2020-26870
CVE-2021-1723
CVE-2021-1725

Impacts:

ACE

Related products:

Microsoft .NET Framework

CVE-IDS:

CVE-2021-16517.8Critical
CVE-2021-16807.8Critical
CVE-2020-268706.1High
CVE-2021-17237.5Critical
CVE-2021-17255.5High

KB list:

4584787

Microsoft official advisories: