PT-2019-1452 · Microsoft · Visual Studio+1

Published 2019-02-12 · Updated 2019-03-06 · CVE-2019-0613

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions .NET Framework versions (affected versions not specified) Visual Studio versions (affected versions not specified)

Description A remote code execution issue exists due to the software's failure to properly check the source markup of a file. This could allow an attacker to run arbitrary code in the context of the current user. If the user has administrative rights, the attacker could gain control of the system, install programs, view or modify data, or create new accounts with full rights. The exploitation requires a user to open a specially crafted file with an affected version of the software.

Recommendations For .NET Framework, update to a version that includes the fix for this issue. For Visual Studio, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of files from untrusted sources to minimize the risk of exploitation. Avoid opening specially crafted files with affected versions of .NET Framework or Visual Studio until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2019-00842

CVE-2019-0613

Affected Products

.Net Framework

Visual Studio

References · 7

• https://osv.dev/vulnerability/CVE-2019-0613 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0613 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00842 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-0613 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0613 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/156451 · Note
• http://securityfocus.com/bid/106872 · Note