CVE-2019-1351Medium
Git for Visual Studio Tampering Vulnerability
🔗 CVE IDs covered (1)
📋 Description
A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, an attacker must clone a file using a specially crafted path on a vulnerable system. The security update fixes the vulnerability by ensuring Git for Visual Studio properly handles folder paths.
🎯 Affected products4
- Microsoft Visual Studio 2017 version 15.0
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- Microsoft Visual Studio 2019 version 16.0
- Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)
✅ Remediation
KBRelease Notes (Security Update)
🔗 References (5)
- advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1351
- patchhttps://aka.ms/vs/15/release/latest
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2017 version 15.0
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2019 version 16.0
- patchhttps://aka.ms/vs/16/release/latest