GitHub: CVE-2024-29187 WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM
🔗 CVE IDs covered (1)
📋 Description
Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
🎯 Affected products29
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
- Microsoft Visual Studio 2022 version 17.10
- Microsoft Visual Studio 2022 version 17.4
- Microsoft Visual Studio 2022 version 17.6
- Microsoft Visual Studio 2022 version 17.8
- Windows 10 HLK Version 22H2
- Windows 11 HLK 22H2
- Windows 11 HLK 23H2
- Windows 11 HLK 24H2
- Windows ADK for Windows 10, version 1607
- Windows ADK for Windows 10, version 1809
- Windows ADK for Windows 10, version 2004
- Windows ADK for Windows 11, version 22H2
- Windows ADK for Windows 11, version 23H2
- Windows ADK for Windows 11, version 24H2
- Windows ADK for Windows Server 2022
- Windows Driver Kit (WDK)
- Windows HLK for Windows Server 2019
- Windows HLK for Windows Server 2022
- Windows HLK, version 1607
- Windows HLK, version 1809
- Windows PE add-on for ADK for Windows 10 version 1809
- Windows PE add-on for ADK for Windows 10 version 2004
- Windows PE add-on for ADK for Windows 11 version 22H2
- Windows PE add-on for ADK for Windows 11 version 23H2
- Windows PE add-on for ADK for Windows 11 version 24H2
- Windows PE add-on for ADK for Windows Server 2022
- Windows SDK
✅ Remediation
KBRelease Notes (Security Update) — fixed build 15.9.65 KBRelease Notes (Security Update) — fixed build 16.11.39 KBRelease Notes (Security Update) — fixed build 17.4.20 KBRelease Notes (Security Update) — fixed build 17.6.18 KBRelease Notes (Security Update) — fixed build 17.8.11 KBRelease Notes (Security Update) — fixed build 17.10.2 KBRelease Notes (Security Update) — fixed build 10.0.26100.1742 KBRelease Notes (Security Update) — fixed build 10.0.26100.3323 KBRelease Notes (Security Update) — fixed build 10.1.19041.5856 KBRelease Notes (Security Update) — fixed build 10.1.25398.1 KBRelease Notes (Security Update) — fixed build 10.1.22621.5337 KBRelease Notes (Security Update) — fixed build 10.1.20348.3694 KBRelease Notes (Security Update) — fixed build 10.1.17763.7320 KBRelease Notes — fixed build 10.0.22621.5337 KBRelease Notes — fixed build 10.0.14393.8069 KBRelease Notes (Security Update) — fixed build 10.1.22621.5193 KBRelease Notes (Security Update) — fixed build 10.1.26100.3916 KBRelease Notes (Security Update) — fixed build 10.1.20348.3567 KBRelease Notes (Security Update) — fixed build 10.1.17763.7250 KBRelease Notes (Security Update) — fixed build 10.1.19041.5738 KBRelease Notes (Security Update) — fixed build 10.1.14393.8069 KBRelease Notes (Security Update) — fixed build 10.1.26100.2454
🔗 References (29)
- advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29187
- patchhttp://aka.ms/vs/15/release/latest
- referencehttps://docs.microsoft.com/en-us/visualstudio/releasenotes/vs2017-relnotes
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2019 version 16.11
- referencehttps://docs.microsoft.com/en-us/visualstudio/releases/2019/release-notes-v16.11
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.4
- referencehttps://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.6
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.8
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.10
- patchhttps://developer.microsoft.com/en-us/windows/downloads/windows-sdk/
- patchhttps://go.microsoft.com/fwlink/?linkid=2307500
- referencehttps://learn.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk
- patchhttps://learn.microsoft.com/en-us/windows-hardware/get-started/adk-install
- referencehttps://learn.microsoft.com/en-us/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-2004
- referencehttps://learn.microsoft.com/en-us/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-adk-101253981-republished-in-january-2025
- referencehttps://learn.microsoft.com/en-us/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-adk-for-windows-11-version-22h2
- referencehttps://learn.microsoft.com/en-us/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-adk-for-windows-server-2022
- referencehttps://learn.microsoft.com/en-us/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-1809
- patchhttps://go.microsoft.com/fwlink/?linkid=2320114
- referencehttps://learn.microsoft.com/en-us/windows-hardware/test/hlk/
- patchhttps://go.microsoft.com/fwlink/?linkid=2327101
- referencehttps://learn.microsoft.com/en-us/windows-hardware/test/hlk/what-s-new-in-the-hardware-lab-kit#whats-new-in-previous-releases
- patchhttps://go.microsoft.com/fwlink/?linkid=2320012
- patchhttps://go.microsoft.com/fwlink/?linkid=2320003
- patchhttps://go.microsoft.com/fwlink/?linkid=2319329
- patchhttps://go.microsoft.com/fwlink/?linkid=2320002
- referencehttps://learn.microsoft.com/en-us/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-1607
- referencehttps://learn.microsoft.com/en-us/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-adk-101261002454-december-2024