KLA12173 Multiple vulnerabilities in Microsoft Developer Tools

Detect date:

05/11/2021

Severity:

High

Description:

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges.

Exploitation:

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Affected products:

Visual Studio Code
Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)
Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)
Visual Studio 2019 for Mac version 8.9
.NET 5.0
.NET Core 3.1
Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)
Visual Studio Code Remote - Containers Extension

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2021-31214
CVE-2021-31204
CVE-2021-31213
CVE-2021-31211
CVE-2021-27068

Impacts:

ACE

Related products:

Microsoft Visual Studio

CVE-IDS:

CVE-2021-312147.8Critical
CVE-2021-312047.3High
CVE-2021-312137.8Critical
CVE-2021-312117.8Critical
CVE-2021-270688.8Critical

Microsoft official advisories: