Microsoft Visual Studio XML Data information disclosure

Summaryinfo

A vulnerability described as critical has been identified in Microsoft Visual Studio 2010 SP1/2013 Update 5/2015 Update 3/2015 Update 5. This issue affects some unknown processing of the component XML Data Handler. Executing a manipulation can lead to information disclosure. This vulnerability appears as CVE-2019-1079. The attack may be performed from remote. There is no available exploit. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability classified as critical was found in Microsoft Visual Studio 2010 SP1/2013 Update 5/2015 Update 3/2015 Update 5 (Programming Tool Software). This vulnerability affects an unknown code block of the component XML Data Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An information disclosure vulnerability exists when Visual Studio improperly parses XML input in certain settings files, aka 'Visual Studio Information Disclosure Vulnerability'.

The weakness was presented 07/09/2019 as confirmed security update guide (Website). The advisory is shared for download at portal.msrc.microsoft.com. The public release was coordinated in cooperation with the vendor. This vulnerability was named CVE-2019-1079 since 11/26/2018. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592. The advisory points out:

An information disclosure vulnerability exists when Visual Studio improperly parses XML input in certain settings files. An attacker who successfully exploited this vulnerability could read arbitrary files via an XML external entity (XXE) declaration.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

See VDB-137547 for similar entry. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Programming Tool Software

Vendor

• Microsoft

Name

• Visual Studio

Version

• 2010 SP1
• 2013 Update 5
• 2015 Update 3
• 2015 Update 5

License

• commercial

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion