Security Updates for Microsoft Visual Studio Products (September 2019)
Medium Nessus Plugin ID 128708
Synopsis
The Microsoft Visual Studio Products are affected by multiple vulnerabilities.
Description
The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:
- An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges. An attacker with unprivileged access to a vulnerable system could exploit this vulnerability.
The security update addresses the vulnerability by ensuring the Diagnostics Hub Standard Collector Service properly impersonates file operations. (CVE-2019-1232)
- A denial of service vulnerability exists when .NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core web application.
The vulnerability can be exploited remotely, without authentication. The update addresses the vulnerability by correcting how the .NET Core web application handles web requests. (CVE-2019-1301)
Solution
Microsoft has released the following security updates to address this issue:
- KB4513696
- Update 15.9.16 for Visual Studio 2017
- Update 16.0.8 for Visual Studio 2019
- Update 15.0 (26228.98) for Visual Studio 2017
- Update 16.2.5 for Visual Studio 2019