Lucene search

K
kasperskyKaspersky LabKLA12535
HistoryMay 10, 2022 - 12:00 a.m.

KLA12535 Multiple vulnerabilities in Microsoft Developer Tools

2022-05-1000:00:00
Kaspersky Lab
threats.kaspersky.com
74

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.3 High

AI Score

Confidence

Low

0.525 Medium

EPSS

Percentile

97.6%

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code.

Below is a complete list of vulnerabilities:

  1. A denial of service vulnerability in .NET and Visual Studio can be exploited remotely to cause denial of service.
  2. A remote code execution vulnerability in Visual Studio Code can be exploited remotely to execute arbitrary code.
  3. A remote code execution vulnerability in Visual Studio can be exploited remotely to execute arbitrary code.
  4. A denial of service vulnerability in .NET Framework can be exploited remotely to cause denial of service.

Original advisories

CVE-2022-23267

CVE-2022-30129

CVE-2022-29117

CVE-2022-29148

CVE-2022-30130

CVE-2022-29145

Related products

Microsoft-.NET-Framework

Microsoft-Visual-Studio

CVE list

CVE-2022-23267 critical

CVE-2022-30129 critical

CVE-2022-29117 critical

CVE-2022-29148 critical

CVE-2022-30130 warning

CVE-2022-29145 critical

KB list

5014326

5013840

5013870

5013838

5013872

5014329

5013837

5013839

5013871

5013873

5014330

5021243

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

  • ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

  • DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

Affected Products

  • .NET Core 3.1Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10).NET 5.0Microsoft .NET Framework 3.5 AND 4.7.2Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8).NET 6.0Microsoft .NET Framework 4.8Microsoft .NET Framework 3.0 Service Pack 2Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2Microsoft .NET Framework 2.0 Service Pack 2Microsoft .NET Framework 3.5.1Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)Visual Studio CodeMicrosoft .NET Framework 4.6Microsoft Visual Studio 2022 version 17.0Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2Microsoft .NET Framework 3.5Microsoft Visual Studio 2022 version 17.1Microsoft .NET Framework 3.5 AND 4.8

References

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.3 High

AI Score

Confidence

Low

0.525 Medium

EPSS

Percentile

97.6%