Security Updates for Microsoft Visual Studio Products (September 2019)

Medium Nessus Plugin ID 128708

Synopsis

The Microsoft Visual Studio Products are affected by multiple vulnerabilities.

Description

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

- An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges. An attacker with unprivileged access to a vulnerable system could exploit this vulnerability.
The security update addresses the vulnerability by ensuring the Diagnostics Hub Standard Collector Service properly impersonates file operations. (CVE-2019-1232)

- A denial of service vulnerability exists when .NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core web application.
The vulnerability can be exploited remotely, without authentication. The update addresses the vulnerability by correcting how the .NET Core web application handles web requests. (CVE-2019-1301)

Solution

Microsoft has released the following security updates to address this issue:
- KB4513696
- Update 15.9.16 for Visual Studio 2017
- Update 16.0.8 for Visual Studio 2019
- Update 15.0 (26228.98) for Visual Studio 2017
- Update 16.2.5 for Visual Studio 2019

See Also

http://www.nessus.org/u?cfa387b3

http://www.nessus.org/u?1d93e731

http://www.nessus.org/u?a8a4791b

http://www.nessus.org/u?30855885

http://www.nessus.org/u?a8a4791b

Plugin Details

Severity: Medium

ID: 128708

File Name: smb_nt_ms19_sep_visual_studio.nasl

Version: 1.2

Type: local

Agent: windows

Published: 2019/09/11

Updated: 2019/09/13

Dependencies: 88700, 57033

Risk Information

Risk Factor: Medium

CVSS Score Source: CVE-2019-1232

CVSS v2.0

Base Score: 4.1

Vector: CVSS2#AV:L/AC:M/Au:S/C:P/I:P/A:P

CVSS v3.0

Base Score: 6.7

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:microsoft:visual_studio

Required KB Items: SMB/MS_Bulletin_Checks/Possible, installed_sw/Microsoft Visual Studio

Patch Publication Date: 2019/09/10

Vulnerability Publication Date: 2019/09/10

Reference Information

CVE: CVE-2019-1232, CVE-2019-1301

MSKB: 4513696

MSFT: MS19-4513696

IAVA: 2019-A-0332