Windows Diagnostics Hub Elevation of Privilege Vulnerability
🔗 CVE IDs covered (1)
📋 Description
An elevation of privilege vulnerability exists when the Windows Diagnostics Hub Standard Collector Service fails to properly sanitize input, leading to an unsecure library-loading behavior. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The security update addresses the vulnerability by correcting how the Windows Diagnostics Hub Standard Collector Service sanitizes input, to help preclude unintended elevated system privileges.
🎯 Affected products34
- Microsoft Visual Studio 2015 Update 3
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- Microsoft Visual Studio 2019 version 16.0
- Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)
- Microsoft Visual Studio 2019 version 16.6 (includes 16.0 - 16.5)
- Windows 10 Version 1607 for 32-bit Systems
- Windows 10 Version 1607 for x64-based Systems
- Windows 10 Version 1709 for 32-bit Systems
- Windows 10 Version 1709 for ARM64-based Systems
- Windows 10 Version 1709 for x64-based Systems
- Windows 10 Version 1803 for 32-bit Systems
- Windows 10 Version 1803 for ARM64-based Systems
- Windows 10 Version 1803 for x64-based Systems
- Windows 10 Version 1809 for 32-bit Systems
- Windows 10 Version 1809 for ARM64-based Systems
- Windows 10 Version 1809 for x64-based Systems
- Windows 10 Version 1903 for 32-bit Systems
- Windows 10 Version 1903 for ARM64-based Systems
- Windows 10 Version 1903 for x64-based Systems
- Windows 10 Version 1909 for 32-bit Systems
- Windows 10 Version 1909 for ARM64-based Systems
- Windows 10 Version 1909 for x64-based Systems
- Windows 10 Version 2004 for 32-bit Systems
- Windows 10 Version 2004 for ARM64-based Systems
- Windows 10 Version 2004 for x64-based Systems
- Windows 10 for 32-bit Systems
- Windows 10 for x64-based Systems
- Windows Server 2016
- Windows Server 2016 (Server Core installation)
- Windows Server 2019
- +4 more not shown
✅ Remediation
KB4565489 (Security Update) KB4558998 (Security Update) KB4565483 (Security Update) KB4565508 (Security Update) KB4565513 (Security Update) KB4565511 (Security Update) KB4565503 (Security Update) KBRelease Notes (Security Update) KB4567703 (Security Update)
🔗 References (16)
- advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1393
- patchhttps://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4565489
- patchhttps://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4558998
- referencehttps://support.microsoft.com/help/4558998
- patchhttps://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4565483
- referencehttps://support.microsoft.com/help/4565483
- patchhttps://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4565508
- patchhttps://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4565513
- patchhttps://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4565511
- referencehttps://support.microsoft.com/help/4565511
- patchhttps://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4565503
- patchhttp://aka.ms/vs/16/release/latest
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2019 version 16.4
- patchhttps://aka.ms/vs/14/release/4567703
- patchhttps://aka.ms/vs/15/release/latest
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2019 version 16.0