KLA12505 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, cause denial of service.

Below is a complete list of vulnerabilities:

1. An elevation of privilege vulnerability in Visual Studio can be exploited remotely to gain privileges.
2. A remote code execution vulnerability in Window Visual Studio can be exploited remotely to execute arbitrary code.
3. A denial of service vulnerability in .NET Framework can be exploited remotely to cause denial of service.
4. An elevation of privilege vulnerability in Visual Studio Code can be exploited remotely to gain privileges.
5. A denial of service vulnerability in YARP can be exploited remotely to cause denial of service.
6. An elevation of privilege vulnerability in PowerShell can be exploited remotely to gain privileges.

Original advisories

CVE-2022-24513

CVE-2022-24767

CVE-2022-26832

CVE-2022-26921

CVE-2022-24765

CVE-2022-26924

CVE-2022-26788

Related products

Microsoft-.NET-Framework

Microsoft-Visual-Studio

CVE list

CVE-2022-26788 critical

CVE-2022-24513 critical

CVE-2022-24767 critical

CVE-2022-26832 critical

CVE-2022-26921 high

CVE-2022-24765 critical

CVE-2022-26924 critical

KB list

5012596

5012117

5012326

5012332

5012327

5012331

5012329

5012324

5012328

5012325

5012123

5012121

5012120

5012118

5012330

5016568

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Microsoft .NET Framework 4.5.2Microsoft .NET Framework 4.8Microsoft .NET Framework 3.5 AND 4.8Microsoft .NET Framework 3.5 AND 4.7.2PowerShell 7.1PowerShell 7.0PowerShell 7.2YARP 1.0YARP 1.1RC