Kaspersky Threats

Дата обнаружения

10/07/2018

Уровень угрозы

Warning

Описание

Multiple serious vulnerabilities have been found in Microsoft Development Tools. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, perform cross-site scripting attacks, gain privileges and spoof user interface.

Below is a complete list of vulnerabilities:

A security feature bypass vulnerability in .NET Framework can be exploited remotely to bypass security restrictions;
Multiple memory corruption vulnerabilities in ChakraCore can be exploited remotely to execute arbitrary code;
A security feature bypass vulnerability in MSR JavaScript Cryptography Library can be exploited remotely to bypass security restrictions;
A cross-site-scripting (XSS) vulnerability in Microsoft Active Directory Federation Services can be exploited remotely via specially crafted request to perform cross-site scripting attacks;
A command injection vulnerability in Microsoft Wireless Display Adapter V2 can be exploited remotely to execute arbitrary code;
An elevation of privilege vulnerability in .NET Framework can be exploited remotely to gain privileges;
A remote code execution vulnerability in Visual Studio can be exploited remotely to execute arbitrary code;
Multiple remote code execution vulnerabilities in .NET Framework can be exploited remotely to execute arbitrary code;
Miltiple security feature bypass vulnerabilities in ChakraCore can be exploited remotely to bypass security restrictions;
A remote code execution vulnerability in PowerShell Editor Services can be exploited remotely to execute arbitrary code;
A security feature bypass vulnerability in ASP.NET can be exploited remotely to bypass security restrictions;
A tampering vulnerability in Microsoft Visual Studio can be exploited remotely to spoof user interface.

Пораженные продукты

.NET Core 2.0
ASP.NET Core 1.1
ASP.NET Core 1.0
ASP.NET Core 2.0
ASP.NET Web Pages 3.2.3
ASP.NET MVC 5.2
Microsoft Visual Studio 2015 Update 3
Microsoft Visual Studio 2017
Microsoft Visual Studio 2013 Update 5
Microsoft Visual Studio 2010 Service Pack 1
Microsoft Visual Studio 2012 Update 5
Microsoft Visual Studio 2017 Version 15.7.5
Microsoft Visual Studio 2017 Version 15.8 Preview
Expression Blend 4 Service Pack 3
Microsoft .NET Framework 3.5.1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 4.5.2
Microsoft .NET Framework 4.6
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 4.7.2
Microsoft .NET Framework 4.6/4.6.1/4.6.2
Microsoft .NET Framework 4.7/4.7.1/4.7.2
.NET Framework 4.7.2 Developer Pack
ChakraCore
Microsoft Wireless Display Adapter V2 Software Version 2.0.8365
Microsoft Wireless Display Adapter V2 Software Version 2.0.8372
Microsoft Wireless Display Adapter V2 Software Version 2.0.8350
Microsoft Research JavaScript Cryptography Library
Web Customizations for Active Directory Federation Services
PowerShell Extension for Visual Studio Code
PowerShell Editor Services
.NET Core 1.1
.NET Core 1.0