Visual Studio Remote Code Execution Vulnerability

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability in the MSDIA SDK where corrupted PDBs can cause heap overflow,     leading to a crash or remote code execution. (CVE-2023-24897)

  - A remote code execution vulnerability where specially crafted input to git apply -reject can lead to     controlled content writes at arbitrary locations. (CVE-2023-25652)

  - A spoofing vulnerability where Github localization messages refer to a hard-coded path instead of     respecting the runtime prefix that leads to out-of-bound memory writes and crashes. (CVE-2023-25815)

  - An Out-Of-Bounds Write Vulnerability in Autodesk FBX SDK version 2020 or prior may lead to code     execution through maliciously crafted FBX files or information disclosure. (CVE-2023-27909)

  - An information disclosure vulnerability where a user may be tricked into opening a malicious     FBX file. This may exploit a stack buffer overflow (CVE-2023-27910) or heap buffer overflow     (CVE-2023-27911) vulnerability in Autodesk FBX SDK 2020 or prior which may lead to remote code     execution. 

  - A remote code execution vulnerability where a configuration file containing a logic error results     in arbitrary configuration injection. (CVE-2023-29007)

  - A remote code execution vulnerability where the Git for Windows executable responsible for     implementing a SOCKS5 proxy is susceptible to picking up an untrusted configuration on multi-user     machines. (CVE-2023-29011)

  - A remote code execution vulnerability where the Git for Windows Git CMD program incorrectly     searches for a program upon startup, leading to silent arbitrary code execution. (CVE-2023-29012)

  - A remote code execution vulnerability in the .NET SDK during tool restore which can lead to an     elevation of privilege. (CVE-2023-33135)

  - An information disclosure vulnerability by the obj file parser in Visual Studio. (CVE-2023-33139)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication     and execute unauthorized arbitrary commands. (CVE-2023-21808, CVE-2023-21815, CVE-2023-23381)

  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.
    (CVE-2023-21566)

  - A denial of service (DoS) vulnerability. An attacker can exploit this issue to cause the affected     component to deny system or application services. (CVE-2023-21567)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
177249	Security Updates for Microsoft Visual Studio Products (June 2023)	Nessus	Windows : Microsoft Bulletins	high
171443	Security Updates for Microsoft Visual Studio Products (February 2023)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2023-21815

high

Tenable Plugins

high

high