Security Updates for Microsoft Visual Studio 2022/2019 Products (May 2025)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(238332);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/17");

  script_cve_id("CVE-2025-26646");

  script_name(english:"Security Updates for Microsoft Visual Studio 2022/2019 Products (May 2025)");

  script_set_attribute(attribute:"synopsis", value:
"The Microsoft Visual Studio Products are affected by a Network Spoofing Vulnerability");
  script_set_attribute(attribute:"description", value:
"The Microsoft Visual Studio Products are missing security updates. They are, therefore, affected by 
network spoofing vulnerability where External control of file name or path in .NET, Visual Studio, and Build Tools for 
Visual Studio allows an authorized attacker to perform spoofing over a network.

Note that Nessus has not tested for these issues but has instead relied only on the application's 
self-reported version number.");
  
  # https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes-v17.10
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ba2fed34");
  # https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes-v17.12
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?256c5953");
  # https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes-17.8
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cf5a6817");
  # https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes-17.13
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d50cb6bf");

  script_set_attribute(attribute:"solution", value:
"Microsoft has released the following security updates to address this issue:
    - Update 17.8.21 for Visual Studio 2022
    - Update 17.10.15 for Visual Studio 2022
    - Update 17.12.8 for Visual Studio 2022
    - Update 17.13.7 for Visual Studio 2022");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-26646");
  script_cwe_id(73);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:visual_studio");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ms_bulletin_checks_possible.nasl", "microsoft_visual_studio_installed.nbin");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible", "installed_sw/Microsoft Visual Studio", "SMB/Registry/Enumerated");
  script_require_ports(139, 445, "Host/patch_management_checks");

  exit(0);
}

include('vcf_extras_visual_studio.inc');

get_kb_item_or_exit('SMB/Registry/Enumerated');

var app_info = vcf::visual_studio::get_app_info();

var constraints = [
  {'product': '2022', 'min_version': '17.8', 'fixed_version': '17.8.36105.29', 'fixed_display': '17.8.36105.29 (17.8.21)'},
  {'product': '2022', 'min_version': '17.10', 'fixed_version': '17.10.36105.31', 'fixed_display': '17.10.36105.31 (17.10.14)'},
  {'product': '2022', 'min_version': '17.12', 'fixed_version': '17.12.36106.13', 'fixed_display': '17.12.36106.13 (17.12.8)'},
  {'product': '2022', 'min_version': '17.13', 'fixed_version': '17.13.36105.23', 'fixed_display': '17.13.36105.23 (17.13.7)'}
];

vcf::visual_studio::check_version_and_report(
  app_info: app_info,
  constraints: constraints,
  severity: SECURITY_WARNING
);