Multiple vulnerabilities in Microsoft Visual Studio
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2018-8172 CVE-2018-8232 |
| CWE-ID | CWE-20 CWE-264 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Visual Studio Universal components / Libraries / Software for developers Microsoft Expression Blend Universal components / Libraries / Software for developers |
| Vendor | Microsoft |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Improper input validation
EUVDB-ID: #VU13777
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2018-8172
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper check of the source markup of a file for an unbuilt project. A remote unauthenticated attacker can trick the victim into opening a specially crafted file with an affected version of Visual Studio and run arbitrary code in the context of the current user.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsVisual Studio: 15.0 26228.04 - 2015 Update 3
Microsoft Expression Blend: All versions
CPE2.3- cpe:2.3:a:microsoft:visual_studio:15.0:26228.04:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_studio:15.7.5:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_studio:15.8_Preview:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_studio:2010_Service_Pack_1:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_studio:2012_Update_4:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_studio:2013_Update_5:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_studio:2015_Update_3:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_expression_blend:*:*:*:*:*:*:*:*
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8172
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Security restrictions bypass
EUVDB-ID: #VU13779
Risk: Low
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-8232
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass security restrictions on the target system.
The vulnerability exists due to improper validation of code logic in Microsoft Macro Assembler. A remote unauthenticated attacker can bypass security restrictions and introduce code into an application, which modifies data in an unintended manner.
MitigationInstall updates from vendor's website.
Vulnerable software versionsVisual Studio: 15.0 26228.04 - 15.8 Preview
CPE2.3- cpe:2.3:a:microsoft:visual_studio:15.0:26228.04:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_studio:15.7.5:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_studio:15.8_Preview:*:*:*:*:*:*:*
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8232
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
