Microsoft security alert.
March 10, 2015
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 44 vulnerabilities that were fixed in 14 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 14 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Internet Explorer Cumulative Security Update (MS15-018)
- Severity
- Critical 4
- Qualys ID
- 100227
- Vendor Reference
- MS15-018
- CVE Reference
- CVE-2015-0032, CVE-2015-0056, CVE-2015-0072, CVE-2015-0099, CVE-2015-0100, CVE-2015-1622, CVE-2015-1623, CVE-2015-1624, CVE-2015-1625, CVE-2015-1626, CVE-2015-1627, CVE-2015-1634
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft Internet Explorer is a graphical web browser developed by Microsoft and included as part of the Microsoft Windows operating systems.
This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer.
This security update is rated Critical for Internet Explorer 6 (IE 6), Internet Explorer 7 (IE 7), Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows clients, and Moderate for Internet Explorer 6 (IE 6), Internet Explorer 7 (IE 7), Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows servers.
- Consequence
- Successful exploitation of this vulnerability will allow an attacker to execute arbitrary code, failed exploits may result in denial of service.
- Solution
-
Refer to Microsoft Security Bulletin MS15-018 for details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-018 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 10)
MS15-018 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 11)
MS15-018 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 8)
MS15-018 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 9)
MS15-018 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 10)
MS15-018 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 11)
MS15-018 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 8)
MS15-018 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 9)
MS15-018 Windows 8 for 32-bit Systems(Internet Explorer 10)
MS15-018 Windows 8 for x64-based Systems(Internet Explorer 10)
MS15-018 Windows 8.1 for 32-bit Systems(Internet Explorer 11)
MS15-018 Windows 8.1 for x64-based Systems(Internet Explorer 11)
MS15-018 Windows Server 2003 Service Pack 2(Internet Explorer 6)
MS15-018 Windows Server 2003 Service Pack 2(Internet Explorer 7)
MS15-018 Windows Server 2003 Service Pack 2(Internet Explorer 8)
MS15-018 Windows Server 2003 with SP2 for Itanium-based Systems(Internet Explorer 6)
MS15-018 Windows Server 2003 with SP2 for Itanium-based Systems(Internet Explorer 7)
MS15-018 Windows Server 2003 x64 Edition Service Pack 2(Internet Explorer 6)
MS15-018 Windows Server 2003 x64 Edition Service Pack 2(Internet Explorer 7)
MS15-018 Windows Server 2003 x64 Edition Service Pack 2(Internet Explorer 8)
MS15-018 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1(Internet Explorer 8)
MS15-018 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 10)
MS15-018 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 11)
MS15-018 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 8)
MS15-018 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 9)
MS15-018 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 7)
MS15-018 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 8)
MS15-018 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 9)
MS15-018 Windows Server 2008 for Itanium-based Systems Service Pack 2(Internet Explorer 7)
MS15-018 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 7)
MS15-018 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 8)
MS15-018 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 9)
MS15-018 Windows Server 2012(Internet Explorer 10)
MS15-018 Windows Server 2012 R2(Internet Explorer 11)
MS15-018 Windows Vista Service Pack 2(Internet Explorer 7)
MS15-018 Windows Vista Service Pack 2(Internet Explorer 8)
MS15-018 Windows Vista Service Pack 2(Internet Explorer 9)
MS15-018 Windows Vista x64 Edition Service Pack 2(Internet Explorer 7)
MS15-018 Windows Vista x64 Edition Service Pack 2(Internet Explorer 8)
MS15-018 Windows Vista x64 Edition Service Pack 2(Internet Explorer 9)
-
Microsoft VBScript Engine Remote Code Execution Vulnerability (MS15-019)
- Severity
- Critical 4
- Qualys ID
- 91035
- Vendor Reference
- MS15-019
- CVE Reference
- CVE-2015-0032
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
A remote code execution vulnerability exists in the way that the VBScript engine, when rendered in Internet Explorer, handles objects in memory (CVE-2015-0032).
This security update is rated Critical for affected versions of the VBScript scripting engine on affected Windows clients and Moderate for affected versions of the VBScript scripting engine on affected Windows servers.
- Consequence
- Successfully exploiting this vulnerability might allow a remote attacker to run arbitrary code on the affected system.
- Solution
-
Please refer to MS15-019 for details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-019 Windows Server 2003 Service Pack 2(VBScript 5.6)
MS15-019 Windows Server 2003 Service Pack 2(VBScript 5.7)
MS15-019 Windows Server 2003 with SP2 for Itanium-based Systems(VBScript 5.6)
MS15-019 Windows Server 2003 with SP2 for Itanium-based Systems(VBScript 5.7)
MS15-019 Windows Server 2003 x64 Edition Service Pack 2(VBScript 5.6)
MS15-019 Windows Server 2003 x64 Edition Service Pack 2(VBScript 5.7)
MS15-019 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)(VBScript 5.8)
MS15-019 Windows Server 2008 for 32-bit Systems Service Pack 2(VBScript 5.7)
MS15-019 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)(VBScript 5.7)
MS15-019 Windows Server 2008 for Itanium-based Systems Service Pack 2(VBScript 5.7)
MS15-019 Windows Server 2008 for x64-based Systems Service Pack 2(VBScript 5.7)
MS15-019 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)(VBScript 5.7)
MS15-019 Windows Vista Service Pack 2(VBScript 5.7 )
MS15-019 Windows Vista x64 Edition Service Pack 2(VBScript 5.7)
-
Microsoft Windows Shell Remote Code Execution Vulnerabilities (MS15-020)
- Severity
- Urgent 5
- Qualys ID
- 91029
- Vendor Reference
- MS15-020
- CVE Reference
- CVE-2015-0081, CVE-2015-0096
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
A remote code execution vulnerability exists when Windows Text Services improperly handles objects in memory. To exploit this vulnerability, an attacker would have to convince a user to browse to a specially crafted website or open a specially crafted file.
A remote code execution vulnerability exists when Microsoft Windows improperly handles the loading of DLL files. This vulnerability requires a user to open a file contained within the same working directory as a specially crafted DLL file.
Microsoft has released security updates that address the vulnerabilities by correcting how Microsoft Text Services handles objects in memory and how Microsoft Windows handles the loading of DLL files.
This security update is rated Critical for all supported releases of Microsoft Windows.
QID Detection Logic (Authenticated)
This detection reviews the file version of the shell32.dll and msctf.dll files.Note: Windows XP is end of life and is vulnerable to this issue. For further details see Exploits Against Obsolete Software.
- Consequence
- The vulnerabilities could allow remote code execution if an attacker successfully convinces a user to browse to a specially crafted website, open a specially crafted file, or open a file in a working directory that contains a specially crafted DLL file.
- Solution
-
Refer to MS15-020 to obtain more information.
Workaround:
1) Disable the displaying of icons for shortcuts.Impact of workaround #1: The system may display most icons as a "white" default object icon, which does impact usability.
2) Disable the WebClient service
Impact of workaround #2: When the WebClient service is disabled, Web Distributed Authoring and Versioning (WebDAV) requests are not transmitted. In addition, any services that explicitly depend on the Web Client service will not start, and an error message will be logged in the System log.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-020 Windows 7 for 32-bit Systems Service Pack 1
MS15-020 Windows 7 for 32-bit Systems Service Pack 1
MS15-020 Windows 7 for x64-based Systems Service Pack 1
MS15-020 Windows 7 for x64-based Systems Service Pack 1
MS15-020 Windows 8 for 32-bit Systems
MS15-020 Windows 8 for 32-bit Systems
MS15-020 Windows 8 for x64-based Systems
MS15-020 Windows 8 for x64-based Systems
MS15-020 Windows 8.1 for 32-bit Systems
MS15-020 Windows 8.1 for 32-bit Systems
MS15-020 Windows 8.1 for x64-based Systems
MS15-020 Windows 8.1 for x64-based Systems
MS15-020 Windows Server 2003 Service Pack 2
MS15-020 Windows Server 2003 Service Pack 2
MS15-020 Windows Server 2003 with SP2 for Itanium-based Systems
MS15-020 Windows Server 2003 with SP2 for Itanium-based Systems
MS15-020 Windows Server 2003 x64 Edition Service Pack 2
MS15-020 Windows Server 2003 x64 Edition Service Pack 2
MS15-020 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS15-020 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS15-020 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-020 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-020 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-020 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-020 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-020 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-020 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-020 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-020 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS15-020 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS15-020 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-020 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-020 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-020 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-020 Windows Server 2012
MS15-020 Windows Server 2012
MS15-020 Windows Server 2012
MS15-020 Windows Server 2012
MS15-020 Windows Server 2012 R2
MS15-020 Windows Server 2012 R2
MS15-020 Windows Server 2012 R2
MS15-020 Windows Server 2012 R2
MS15-020 Windows Vista Service Pack 2
MS15-020 Windows Vista Service Pack 2
MS15-020 Windows Vista x64 Edition Service Pack 2
MS15-020 Windows Vista x64 Edition Service Pack 2
-
Microsoft Windows Adobe Font Driver Remote Code Execution Vulnerability (MS15-021)
- Severity
- Urgent 5
- Qualys ID
- 91027
- Vendor Reference
- MS15-021
- CVE Reference
- CVE-2015-0074, CVE-2015-0087, CVE-2015-0088, CVE-2015-0089, CVE-2015-0090, CVE-2015-0091, CVE-2015-0092, CVE-2015-0093
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft Windows is prone to multiple vulnerabilities that affect Adobe Font Driver.
A denial of service vulnerability exists in how the Adobe Font Driver manages memory when parsing fonts.
Multiple information disclosure vulnerabilities exist in the Adobe Font Driver that could allow the disclosure of memory contents to an attacker. These vulnerabilities are caused when the Adobe Font Driver tries to read or display certain fonts.
Multiple remote code execution vulnerabilities exist in the Adobe Font Driver. The vulnerabilities are caused when the Adobe Font Driver improperly overwrites objects in memory.
Microsoft has release a security update that addresses these vulnerabilities by correcting how the font parser allocates memory and by correcting how objects in memory are handled.
This security update is rated Critical for all supported releases of Microsoft Windows.
- Consequence
- Exploitation could allow remote code execution if a user views a specially crafted file or website. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
- Solution
-
Refer to MS15-021 to obtain more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-021 Windows 7 for 32-bit Systems Service Pack 1
MS15-021 Windows 7 for x64-based Systems Service Pack 1
MS15-021 Windows 8 for 32-bit Systems
MS15-021 Windows 8 for x64-based Systems
MS15-021 Windows 8.1 for 32-bit Systems
MS15-021 Windows 8.1 for x64-based Systems
MS15-021 Windows Server 2003 Service Pack 2
MS15-021 Windows Server 2003 with SP2 for Itanium-based Systems
MS15-021 Windows Server 2003 x64 Edition Service Pack 2
MS15-021 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS15-021 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-021 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-021 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-021 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-021 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS15-021 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-021 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-021 Windows Server 2012
MS15-021 Windows Server 2012
MS15-021 Windows Server 2012 R2
MS15-021 Windows Server 2012 R2
MS15-021 Windows Vista Service Pack 2
MS15-021 Windows Vista x64 Edition Service Pack 2
-
Microsoft Office Remote Code Execution Vulnerabilities (MS15-022)
- Severity
- Critical 4
- Qualys ID
- 110251
- Vendor Reference
- MS15-022
- CVE Reference
- CVE-2015-0085, CVE-2015-0086, CVE-2015-0097, CVE-2015-1633, CVE-2015-1636
- CVSS Scores
- Base 9.3 / Temporal 8.1
- Description
-
A remote code execution vulnerability exists in Microsoft Office software that is caused when the Office software improperly handles objects in memory while parsing specially crafted Office files. This could corrupt system memory in such a way as to allow an attacker to execute arbitrary code (CVE-2015-0085).
A remote code execution vulnerability exists in Microsoft Office software when the Office software fails to properly handle rich text format files in memory (CVE-2015-0086).
A remote code execution vulnerability exists in Microsoft Office software that is caused when the Office software improperly handles objects in memory while parsing specially crafted Office files. This could corrupt system memory in such a way as to allow an attacker to execute arbitrary code (CVE-2015-0097).
Elevation of privilege vulnerabilities exist when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server (CVE-2015-1633, CVE-2015-1636).
- Consequence
- Successfully exploiting these vulnerabilities might allow a remote attacker to execute arbitrary code or gain escalated privileges.
- Solution
-
Refer to MS15-022 to obtain more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-022 Microsoft Excel Viewer
MS15-022 Microsoft Office 2007 Service Pack 3(Microsoft Excel 2007 Service Pack 3)
MS15-022 Microsoft Office 2007 Service Pack 3(Microsoft PowerPoint 2007 Service Pack 3)
MS15-022 Microsoft Office 2007 Service Pack 3(Microsoft Word 2007 Service Pack 3)
MS15-022 Microsoft Office 2007 Service Pack 3
MS15-022 Microsoft Office 2010 Service Pack 2 (32-bit editions)(Microsoft Excel 2010 Service Pack 2 (32-bit editions))
MS15-022 Microsoft Office 2010 Service Pack 2 (32-bit editions)(Microsoft PowerPoint 2010 Service Pack 2 (32-bit editions))
MS15-022 Microsoft Office 2010 Service Pack 2 (32-bit editions)(Microsoft Word 2010 Service Pack 2 (32-bit editions))
MS15-022 Microsoft Office 2010 Service Pack 2 (32-bit editions)
MS15-022 Microsoft Office 2010 Service Pack 2 (32-bit editions)
MS15-022 Microsoft Office 2010 Service Pack 2 (32-bit editions)
MS15-022 Microsoft Office 2010 Service Pack 2 (32-bit editions)
MS15-022 Microsoft Office 2010 Service Pack 2 (64-bit editions)(Microsoft Excel 2010 Service Pack 2 (64-bit editions))
MS15-022 Microsoft Office 2010 Service Pack 2 (64-bit editions)(Microsoft PowerPoint 2010 Service Pack 2 (64-bit editions))
MS15-022 Microsoft Office 2010 Service Pack 2 (64-bit editions)(Microsoft Word 2010 Service Pack 2 (64-bit editions))
MS15-022 Microsoft Office 2010 Service Pack 2 (64-bit editions)
MS15-022 Microsoft Office 2010 Service Pack 2 (64-bit editions)
MS15-022 Microsoft Office 2010 Service Pack 2 (64-bit editions)
MS15-022 Microsoft Office 2010 Service Pack 2 (64-bit editions)
MS15-022 Microsoft Office 2013 (32-bit editions)(Microsoft Word 2013 (32-bit editions))
MS15-022 Microsoft Office 2013 (32-bit editions)
MS15-022 Microsoft Office 2013 (64-bit editions)(Microsoft Word 2013 (64-bit editions))
MS15-022 Microsoft Office 2013 (64-bit editions)
MS15-022 Microsoft Office 2013 Service Pack 1 (32-bit editions)(Microsoft Word 2013 Service Pack 1 (32-bit editions))
MS15-022 Microsoft Office 2013 Service Pack 1 (32-bit editions)
MS15-022 Microsoft Office 2013 Service Pack 1 (64-bit editions)(Microsoft Word 2013 Service Pack 1 (64-bit editions))
MS15-022 Microsoft Office 2013 Service Pack 1 (64-bit editions)
MS15-022 Microsoft Office Compatibility Pack Service Pack 3
MS15-022 Microsoft Office Compatibility Pack Service Pack 3
MS15-022 Microsoft Office Web Apps 2010 Service Pack 2(Microsoft Office Web Apps Server 2010 Service Pack 2)
MS15-022 Microsoft Office Web Apps 2010 Service Pack 2(Microsoft Web Applications 2010 Service Pack 2)
MS15-022 Microsoft Office Web Apps 2013(Microsoft Office Web Apps Server 2013)
MS15-022 Microsoft Office Web Apps 2013 Service Pack 1(Microsoft Office Web Apps Server 2013 Service Pack 1)
MS15-022 Microsoft SharePoint Server 2007 Service Pack 3 (32-bit editions)
MS15-022 Microsoft SharePoint Server 2007 Service Pack 3 (64-bit editions)
MS15-022 Microsoft SharePoint Server 2010 Service Pack 2(Microsoft SharePoint Foundation 2010 Service Pack 2)
MS15-022 Microsoft SharePoint Server 2010 Service Pack 2(Microsoft SharePoint Server 2010 Service Pack 2)
MS15-022 Microsoft SharePoint Server 2010 Service Pack 2(Word Automation Services)
MS15-022 Microsoft SharePoint Server 2013(Excel Services)
MS15-022 Microsoft SharePoint Server 2013(Microsoft SharePoint Foundation 2013)
MS15-022 Microsoft SharePoint Server 2013(Microsoft SharePoint Foundation 2013)
MS15-022 Microsoft SharePoint Server 2013(Microsoft SharePoint Foundation 2013)
MS15-022 Microsoft SharePoint Server 2013(Microsoft SharePoint Server 2013)
MS15-022 Microsoft SharePoint Server 2013(Microsoft SharePoint Server 2013)
MS15-022 Microsoft SharePoint Server 2013(Microsoft SharePoint Server 2013)
MS15-022 Microsoft SharePoint Server 2013(Microsoft SharePoint Server 2013)
MS15-022 Microsoft SharePoint Server 2013(Microsoft SharePoint Server 2013)
MS15-022 Microsoft SharePoint Server 2013(Microsoft SharePoint Server 2013)
MS15-022 Microsoft SharePoint Server 2013(Microsoft SharePoint Server 2013)
MS15-022 Microsoft SharePoint Server 2013(Microsoft SharePoint Server 2013)
MS15-022 Microsoft SharePoint Server 2013(Word Automation Services)
MS15-022 Microsoft SharePoint Server 2013 Service Pack 1(Excel Services)
MS15-022 Microsoft SharePoint Server 2013 Service Pack 1(Microsoft SharePoint Foundation 2013 Service Pack 1)
MS15-022 Microsoft SharePoint Server 2013 Service Pack 1(Microsoft SharePoint Foundation 2013 Service Pack 1)
MS15-022 Microsoft SharePoint Server 2013 Service Pack 1(Microsoft SharePoint Foundation 2013 Service Pack 1)
MS15-022 Microsoft SharePoint Server 2013 Service Pack 1(Microsoft SharePoint Server 2013 Service Pack 1)
MS15-022 Microsoft SharePoint Server 2013 Service Pack 1(Microsoft SharePoint Server 2013 Service Pack 1)
MS15-022 Microsoft SharePoint Server 2013 Service Pack 1(Microsoft SharePoint Server 2013 Service Pack 1)
MS15-022 Microsoft SharePoint Server 2013 Service Pack 1(Microsoft SharePoint Server 2013 Service Pack 1)
MS15-022 Microsoft SharePoint Server 2013 Service Pack 1(Microsoft SharePoint Server 2013 Service Pack 1)
MS15-022 Microsoft SharePoint Server 2013 Service Pack 1(Microsoft SharePoint Server 2013 Service Pack 1)
MS15-022 Microsoft SharePoint Server 2013 Service Pack 1(Microsoft SharePoint Server 2013 Service Pack 1)
MS15-022 Microsoft SharePoint Server 2013 Service Pack 1(Microsoft SharePoint Server 2013 Service Pack 1)
MS15-022 Microsoft SharePoint Server 2013 Service Pack 1(Word Automation Services)
MS15-022 Microsoft Windows SharePoint Services 3.0 Service Pack 3 (32-bit versions)
MS15-022 Microsoft Windows SharePoint Services 3.0 Service Pack 3 (64-bit versions)
MS15-022 Microsoft Word Viewer
MS15-022
MS15-022
-
Microsoft Windows Kernel-Mode Driver Privilege Escalation Vulnerability (MS15-023)
- Severity
- Critical 4
- Qualys ID
- 91028
- Vendor Reference
- MS15-023
- CVE Reference
- CVE-2015-0077, CVE-2015-0078, CVE-2015-0094, CVE-2015-0095
- CVSS Scores
- Base 7.2 / Temporal 6
- Description
-
The security update addresses the vulnerabilities by changing how the kernel-mode driver handles objects in memory and by correcting how it validates a calling threads token.
An elevation of privilege vulnerability exists in the Windows kernel-mode driver that is caused when the kernel-mode driver fails to properly validate the calling threads token. (CVE-2015-0078)
An information disclosure vulnerability exists in the Windows kernel-mode driver that could allow the disclosure of kernel memory contents to an attacker. (CVE-2015-0077, CVE-2015-0094, CVE-2015-0095)
The most severe of the vulnerabilities could allow elevation of privilege if an attacker logs on to the system and runs a specially crafted application designed to increase privileges.This security update is rated Important for all supported releases of Microsoft Windows.
- Consequence
- An authenticated attacker who successfully exploited this vulnerability could acquire administrator credentials and use them to elevate privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.
- Solution
-
Refer to MS15-023 to obtain more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-023 Windows 7 for 32-bit Systems Service Pack 1
MS15-023 Windows 7 for x64-based Systems Service Pack 1
MS15-023 Windows 8 for 32-bit Systems
MS15-023 Windows 8 for x64-based Systems
MS15-023 Windows 8.1 for 32-bit Systems
MS15-023 Windows 8.1 for x64-based Systems
MS15-023 Windows Server 2003 Service Pack 2
MS15-023 Windows Server 2003 with SP2 for Itanium-based Systems
MS15-023 Windows Server 2003 x64 Edition Service Pack 2
MS15-023 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS15-023 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-023 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-023 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-023 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-023 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS15-023 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-023 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-023 Windows Server 2012
MS15-023 Windows Server 2012
MS15-023 Windows Server 2012 R2
MS15-023 Windows Server 2012 R2
MS15-023 Windows Vista Service Pack 2
MS15-023 Windows Vista x64 Edition Service Pack 2
-
Microsoft Windows PNG Processing Information Disclosure Vulnerability (MS15-024)
- Severity
- Critical 4
- Qualys ID
- 91026
- Vendor Reference
- MS15-024
- CVE Reference
- CVE-2015-0080
- CVSS Scores
- Base 4.3 / Temporal 3.4
- Description
-
An information disclosure vulnerability exists when Windows fails to properly handle uninitialized memory when parsing certain, specially crafted PNG image format files. The vulnerability could allow information disclosure if an attacker convinces a user to visit a website that contains specially crafted PNG images.
Microsoft has released a security update that addresses the vulnerability correcting how Windows processes PNG image format files.
The security update is rated Important for all supported releases of Microsoft Windows.
- Consequence
- An attacker who successfully exploited this vulnerability could potentially read data which was not intended to be disclosed.
- Solution
-
Refer to MS15-024 for further information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-024 Windows 7 for 32-bit Systems Service Pack 1
MS15-024 Windows 7 for x64-based Systems Service Pack 1
MS15-024 Windows 8 for 32-bit Systems
MS15-024 Windows 8 for x64-based Systems
MS15-024 Windows 8.1 for 32-bit Systems
MS15-024 Windows 8.1 for x64-based Systems
MS15-024 Windows Server 2003 Service Pack 2
MS15-024 Windows Server 2003 with SP2 for Itanium-based Systems
MS15-024 Windows Server 2003 x64 Edition Service Pack 2
MS15-024 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS15-024 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-024 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-024 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-024 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-024 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS15-024 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-024 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-024 Windows Server 2012
MS15-024 Windows Server 2012
MS15-024 Windows Server 2012 R2
MS15-024 Windows Server 2012 R2
MS15-024 Windows Vista Service Pack 2
MS15-024 Windows Vista x64 Edition Service Pack 2
-
Microsoft Windows Kernel Elevation of Privilege Vulnerabilities (MS15-025)
- Severity
- Urgent 5
- Qualys ID
- 91034
- Vendor Reference
- MS15-025
- CVE Reference
- CVE-2015-0073, CVE-2015-0075
- CVSS Scores
- Base 7.2 / Temporal 6
- Description
-
An elevation of privilege vulnerability exists in the way that Windows Registry Virtualization improperly allows a user to modify the virtual store of another user.
Affected Software:
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
Windows 8 for 32-bit Systems
Windows 8 for x64-based Systems
Windows 8.1 for 32-bit Systems
Windows 8.1 for x64-based Systems
Windows Server 2012
Windows Server 2012 R2
Windows RT
Windows RT 8.1This security update is rated Important for all supported releases of Microsoft Windows.
- Consequence
- An attacker who successfully exploited this vulnerability can run arbitrary code in the security context of the account of another user who is logged on to the affected system. An attacker can then install programs, view, change, or delete data, or create new accounts potentially with full user rights.
- Solution
-
Refer to MS15-025 to obtain more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-025 Windows 7 for 32-bit Systems Service Pack 1
MS15-025 Windows 7 for x64-based Systems Service Pack 1
MS15-025 Windows 8 for 32-bit Systems
MS15-025 Windows 8 for x64-based Systems
MS15-025 Windows 8.1 for 32-bit Systems
MS15-025 Windows 8.1 for x64-based Systems
MS15-025 Windows Server 2003 Service Pack 2
MS15-025 Windows Server 2003 with SP2 for Itanium-based Systems
MS15-025 Windows Server 2003 x64 Edition Service Pack 2
MS15-025 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS15-025 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-025 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-025 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-025 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-025 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS15-025 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-025 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-025 Windows Server 2012
MS15-025 Windows Server 2012
MS15-025 Windows Server 2012 R2
MS15-025 Windows Server 2012 R2
MS15-025 Windows Vista Service Pack 2
MS15-025 Windows Vista x64 Edition Service Pack 2
-
Microsoft Exchange Server Elevation of Privilege Vulnerabilities (MS15-026)
- Severity
- Critical 4
- Qualys ID
- 74275
- Vendor Reference
- MS15-026
- CVE Reference
- CVE-2015-1628, CVE-2015-1629, CVE-2015-1630, CVE-2015-1631, CVE-2015-1632
- CVSS Scores
- Base 5 / Temporal 3.7
- Description
-
Elevation of privilege vulnerabilities exist when Microsoft Exchange Server does not properly sanitize page content in Outlook Web App.
Affected Software:
Microsoft Exchange Server 2013 Service Pack 1
Microsoft Exchange Server 2013 Cumulative Update 7 - Consequence
- An attacker who successfully exploited these vulnerabilities can run script in the context of the current user. The script can then, for example, use the victim's identity to take actions on the affected Outlook Web App site on behalf of the victim with the same permissions as the current user.
- Solution
-
Refer to MS15-026 to obtain more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-026 Microsoft Exchange Server 2013 Cumulative Update 7
MS15-026 Microsoft Exchange Server 2013 Service Pack 1
-
Microsoft Windows NETLOGON Spoofing Vulnerability (MS15-027)
- Severity
- Critical 4
- Qualys ID
- 91030
- Vendor Reference
- MS15-027
- CVE Reference
- CVE-2015-0005
- CVSS Scores
- Base 4.3 / Temporal 3.6
- Description
-
The update addresses the vulnerability by modifying the way that Netlogon handles establishing secure channels.
The vulnerability could allow spoofing if an attacker who is logged on to a domain-joined system runs a specially crafted application that could establish a connection with other domain-joined systems as the impersonated user or system.
This security update is rated Important for all supported editions of Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows 2012, and Windows 2012 R2.
- Consequence
- An attacker could run a specially crafted application that could establish a secure channel connection belonging to different computer. An attacker may be able to use the established secure channel to obtain session-related information for the actual secure channel of the spoofed computer.
- Solution
-
Refer to Microsoft Security Bulletin MS15-027 for further details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-027 Windows Server 2003 Service Pack 2
MS15-027 Windows Server 2003 with SP2 for Itanium-based Systems
MS15-027 Windows Server 2003 x64 Edition Service Pack 2
MS15-027 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS15-027 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-027 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-027 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-027 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-027 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS15-027 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-027 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-027 Windows Server 2012
MS15-027 Windows Server 2012
MS15-027 Windows Server 2012 R2
MS15-027 Windows Server 2012 R2
-
Windows Task Scheduler Security Feature Bypass (MS15-028)
- Severity
- Serious 3
- Qualys ID
- 91032
- Vendor Reference
- MS15-028
- CVE Reference
- CVE-2015-0084
- CVSS Scores
- Base 2.1 / Temporal 1.6
- Description
-
Task Scheduler is a Windows service that enables the automation of routine tasks on a chosen computer. Task Scheduler does this by monitoring the criteria the user has chosen for initiating tasks (referred to as triggers) and then executing the tasks when the criteria has been met. For more information, see the MSDN Library entry.
A security feature bypass vulnerability exists when Windows Task Scheduler fails to properly validate and enforce impersonation levels.
Affected Software:
Windows 7 Service Pack 1
Windows Server 2008 R2 Service Pack 1
Windows 8 and Windows 8.1
Windows Server 2012 and Windows Server 2012 R2
Windows RT and Windows RT 8.1
This security update is rated Important.
- Consequence
- An attacker who successfully exploited this vulnerability could bypass access control list (ACL) checks and run privileged programs.
- Solution
-
Refer to MS15-028 for further information.
Workaround:
Turn off the Task Scheduler service.
Impact of workaround. Scheduled tasks will no longer run.Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-028 Windows 7 for 32-bit Systems Service Pack 1
MS15-028 Windows 7 for x64-based Systems Service Pack 1
MS15-028 Windows 8 for 32-bit Systems
MS15-028 Windows 8 for x64-based Systems
MS15-028 Windows 8.1 for 32-bit Systems
MS15-028 Windows 8.1 for x64-based Systems
MS15-028 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS15-028 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-028 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-028 Windows Server 2012
MS15-028 Windows Server 2012
MS15-028 Windows Server 2012 R2
MS15-028 Windows Server 2012 R2
-
Windows Photo Decoder Component Information Disclosure (MS15-029)
- Severity
- Serious 3
- Qualys ID
- 91033
- Vendor Reference
- MS15-029
- CVE Reference
- CVE-2015-0076
- CVSS Scores
- Base 4.3 / Temporal 3.6
- Description
-
An information disclosure vulnerability exists when Windows fails to properly handle uninitialized memory when parsing certain, specially crafted JPEG XR (.JXR) image format files.
Affected Software:
Windows Vista Service Pack 2
Windows 7 Service Pack 1
Windows Server 2008 R2 Service Pack 1
Windows Server 2008 Service Pack 2
Windows 8 and Windows 8.1
Windows Server 2012 and Windows Server 2012 R2
Windows RT and Windows RT 8.1
This security update is rated Important.
- Consequence
- An attacker who successfully exploited this vulnerability could potentially read data that was not intended to be disclosed. The disclosed data could be used to obtain information that could be used to try to further compromise the affected system.
- Solution
-
Refer to MS15-029 for further information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-029 Windows 7 for 32-bit Systems Service Pack 1
MS15-029 Windows 7 for x64-based Systems Service Pack 1
MS15-029 Windows 8 for 32-bit Systems
MS15-029 Windows 8 for x64-based Systems
MS15-029 Windows 8.1 for 32-bit Systems
MS15-029 Windows 8.1 for x64-based Systems
MS15-029 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS15-029 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-029 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-029 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS15-029 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-029 Windows Server 2012
MS15-029 Windows Server 2012 R2
MS15-029 Windows Vista Service Pack 2
MS15-029 Windows Vista x64 Edition Service Pack 2
-
Microsoft Windows Remote Desktop Denial of Service Vulnerability (MS15-030)
- Severity
- Serious 3
- Qualys ID
- 91031
- Vendor Reference
- MS15-030
- CVE Reference
- CVE-2015-0079
- CVSS Scores
- Base 7.8 / Temporal 5.8
- Description
-
Remote Desktop Protocol (RDP) lets users create a virtual session on their desktop computers. RDP allows remote users to access all of the data and applications on their computers.
A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker creates multiple RDP sessions that fail to properly free objects in memory.
This security update is rated Important for all supported editions of Windows 7, Windows 8, Windows Server 2012, Window 8.1, and Windows Server 2012 R2.
- Consequence
- Successful exploitation could allow an attacker to cause the target system to stop responding.
- Solution
-
Customers are advised to refer to Microsoft Advisory MS15-030 for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-030 Windows 7 for 32-bit Systems Service Pack 1
MS15-030 Windows 7 for 32-bit Systems Service Pack 1
MS15-030 Windows 7 for x64-based Systems Service Pack 1
MS15-030 Windows 7 for x64-based Systems Service Pack 1
MS15-030 Windows 8 for 32-bit Systems
MS15-030 Windows 8 for x64-based Systems
MS15-030 Windows 8.1 for 32-bit Systems
MS15-030 Windows 8.1 for x64-based Systems
MS15-030 Windows Server 2012
MS15-030 Windows Server 2012
MS15-030 Windows Server 2012 R2
MS15-030 Windows Server 2012 R2
-
Microsoft Schannel Security Feature Bypass Vulnerability (MS15-031) (FREAK)
- Severity
- Critical 4
- Qualys ID
- 91025
- Vendor Reference
- MS15-031
- CVE Reference
- CVE-2015-1637
- CVSS Scores
- Base 4.3 / Temporal 3.6
- Description
-
Microsoft announces a security feature bypass vulnerability in Secure Channel (Schannel) that affects all supported releases of Microsoft Windows.
The vulnerability can allow an attacker to force the downgrading of the cipher suites used in an SSL/TLS connection on a Windows client system. The vulnerability facilitates exploitation of the publicly disclosed FREAK technique.
Affected Operating Systems:
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
Windows 8 for 32-bit Systems
Windows 8 for x64-based Systems
Windows 8.1 for 32-bit Systems
Windows 8.1 for x64-based Systems
Windows Server 2012
Windows Server 2012 R2
Windows RT
Windows RT 8.1 - Consequence
- An attacker who successfully exploited this vulnerability could facilitate man-in-the-middle attacks that could decrypt encrypted traffic.
- Solution
-
Please refer to MS15-031 for details.
Workaround:
Disable RSA key exchange ciphers using the Group Policy Object Editor (Windows Vista and later systems only)Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-031 Windows 7 for 32-bit Systems Service Pack 1
MS15-031 Windows 7 for x64-based Systems Service Pack 1
MS15-031 Windows 8 for 32-bit Systems
MS15-031 Windows 8 for x64-based Systems
MS15-031 Windows 8.1 for 32-bit Systems
MS15-031 Windows 8.1 for x64-based Systems
MS15-031 Windows Server 2003 Service Pack 2
MS15-031 Windows Server 2003 with SP2 for Itanium-based Systems
MS15-031 Windows Server 2003 x64 Edition Service Pack 2
MS15-031 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS15-031 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-031 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-031 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-031 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-031 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS15-031 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-031 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-031 Windows Server 2012
MS15-031 Windows Server 2012
MS15-031 Windows Server 2012 R2
MS15-031 Windows Server 2012 R2
MS15-031 Windows Vista Service Pack 2
MS15-031 Windows Vista x64 Edition Service Pack 2
These new vulnerability checks are included in Qualys vulnerability signature 2.2.957-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 100227
- 91035
- 91029
- 91027
- 110251
- 91028
- 91026
- 91034
- 74275
- 91030
- 91032
- 91033
- 91031
- 91025
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.