Microsoft security alert.
October 13, 2015
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 30 vulnerabilities that were fixed in 6 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 6 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Internet Explorer Cumulative Security Update (MS15-106)
- Severity
- Urgent 5
- Qualys ID
- 100259
- Vendor Reference
- MS15-106
- CVE Reference
- CVE-2015-2482, CVE-2015-6042, CVE-2015-6044, CVE-2015-6045, CVE-2015-6046, CVE-2015-6047, CVE-2015-6048, CVE-2015-6049, CVE-2015-6050, CVE-2015-6051, CVE-2015-6052, CVE-2015-6053, CVE-2015-6055, CVE-2015-6056, CVE-2015-6059
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft Internet Explorer is a graphical web browser developed by Microsoft and included as part of the Microsoft Windows operating systems.
This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer.
This security update is rated Critical for Internet Explorer 7 (IE 7), Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows clients, and Moderate for Internet Explorer 7 (IE 7), Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows servers.
- Consequence
- An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user.
- Solution
-
Customers are advised to refer to Microsoft Advisory MS15-106 for more details.
Workaround:
-Restrict access to VBScript.dll and JScript.dll
-Remove the .rdp file association.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-106 Windows 10 for 32-bit Systems
MS15-106 Windows 10 for x64-based Systems
MS15-106 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 10)
MS15-106 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 11)
MS15-106 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 8)
MS15-106 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 9)
MS15-106 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 10)
MS15-106 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 11)
MS15-106 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 8)
MS15-106 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 9)
MS15-106 Windows 8 for 32-bit Systems(Internet Explorer 10)
MS15-106 Windows 8 for x64-based Systems(Internet Explorer 10)
MS15-106 Windows 8.1 for 32-bit Systems(Internet Explorer 11)
MS15-106 Windows 8.1 for x64-based Systems(Internet Explorer 11)
MS15-106 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1(Internet Explorer 8)
MS15-106 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 10)
MS15-106 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 11)
MS15-106 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 8)
MS15-106 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 9)
MS15-106 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 7)
MS15-106 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 8)
MS15-106 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 9)
MS15-106 Windows Server 2008 for Itanium-based Systems Service Pack 2(Internet Explorer 7)
MS15-106 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 7)
MS15-106 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 8)
MS15-106 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 9)
MS15-106 Windows Server 2012(Internet Explorer 10)
MS15-106 Windows Server 2012 R2(Internet Explorer 11)
MS15-106 Windows Vista Service Pack 2(Internet Explorer 7)
MS15-106 Windows Vista Service Pack 2(Internet Explorer 8)
MS15-106 Windows Vista Service Pack 2(Internet Explorer 9)
MS15-106 Windows Vista x64 Edition Service Pack 2(Internet Explorer 7)
MS15-106 Windows Vista x64 Edition Service Pack 2(Internet Explorer 8)
MS15-106 Windows Vista x64 Edition Service Pack 2(Internet Explorer 9)
-
Microsoft Edge Cumulative Security Update (MS15-107)
- Severity
- Critical 4
- Qualys ID
- 91102
- Vendor Reference
- MS15-107
- CVE Reference
- CVE-2015-6057, CVE-2015-6058
- CVSS Scores
- Base 5 / Temporal 3.7
- Description
-
Microsoft Edge is a web browser developed by Microsoft and included in the company's Windows 10 operating systems, replacing Internet Explorer as the default web browser on all device classes.
This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow information disclosure if a user views a specially crafted webpage using Microsoft Edge.
This security update is rated Important for Microsoft Edge on Windows 10.
- Consequence
- An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user.
- Solution
-
Refer to Microsoft Security Bulletin MS15-107 for details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-107 Windows 10 for 32-bit Systems
MS15-107 Windows 10 for x64-based Systems
-
Microsoft JScript and VBScript Remote Code Execution Vulnerabilities (MS15-108)
- Severity
- Urgent 5
- Qualys ID
- 91101
- Vendor Reference
- MS15-108
- CVE Reference
- CVE-2015-6052, CVE-2015-6059
- CVSS Scores
- Base 4.3 / Temporal 3.6
- Description
-
Remote code execution vulnerabilities exist in the way that the VBScript and JScript engines, when handling objects in memory in Internet Explorer.
A security feature bypass exists when the VBScript and JScript engines fail to use the Address Space Layout Randomization (ASLR) security feature, allowing an attacker to more reliably predict the memory offsets of specific instructions in a given call stack.
An information disclosure vulnerability exists when JScript or VBScript improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the users computer or data.
This security update is rated Critical for affected versions of the JScript and VBScript scripting engines on supported editions of Windows Vista, Windows Server 2008, and Server Core installations of Windows Server 2008 R2.
- Consequence
- Successful exploitation allows attacker to execute arbitrary code.
- Solution
-
Please refer to MS15-108 for details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-108 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Server Core installation only)(JScript 5.8 and VBScript 5.8)
MS15-108 Windows Server 2008 for 32-bit Systems Service Pack 2(JScript 5.7 and VBScript 5.7)
MS15-108 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)(JScript 5.7 and VBScript 5.7)
MS15-108 Windows Server 2008 for Itanium-based Systems Service Pack 2(JScript 5.7 and VBScript 5.7)
MS15-108 Windows Server 2008 for x64-based Systems Service Pack 2(JScript 5.7 and VBScript 5.7)
MS15-108 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)(JScript 5.7 and VBScript 5.7)
MS15-108 Windows Vista Service Pack 2(JScript 5.7 and VBScript 5.7)
MS15-108 Windows Vista x64 Edition Service Pack 2(JScript 5.7 and VBScript 5.7)
-
Microsoft Windows Shell Remote Code Execution Vulnerabilities (MS15-109)
- Severity
- Critical 4
- Qualys ID
- 91099
- Vendor Reference
- MS15-109
- CVE Reference
- CVE-2015-2515, CVE-2015-2548
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
A remote code execution vulnerability exists when Windows Shell improperly handles objects in memory. An attacker who successfully exploited this vulnerability could cause arbitrary code to execute in the context of the current user (CVE-2015-2515).
A remote code execution vulnerability exists when the Microsoft Tablet Input Band fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user (CVE-2015-2548).
This security update is rated Critical for all supported releases of Microsoft Windows.
- Consequence
- Successfully exploiting these vulnerabilities might allow a remote attacker to execute arbitrary code on the vulnerable system.
- Solution
-
Refer to Microsoft Security Bulletin MS15-109 for details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-109 Windows 10 for 32-bit Systems
MS15-109 Windows 10 for x64-based Systems
MS15-109 Windows 7 for 32-bit Systems Service Pack 1
MS15-109 Windows 7 for 32-bit Systems Service Pack 1
MS15-109 Windows 7 for x64-based Systems Service Pack 1
MS15-109 Windows 7 for x64-based Systems Service Pack 1
MS15-109 Windows 8 for 32-bit Systems
MS15-109 Windows 8 for x64-based Systems
MS15-109 Windows 8.1 for 32-bit Systems
MS15-109 Windows 8.1 for x64-based Systems
MS15-109 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS15-109 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-109 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-109 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-109 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-109 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS15-109 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-109 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-109 Windows Server 2012
MS15-109 Windows Server 2012
MS15-109 Windows Server 2012 R2
MS15-109 Windows Server 2012 R2
MS15-109 Windows Vista Service Pack 2
MS15-109 Windows Vista Service Pack 2
MS15-109 Windows Vista x64 Edition Service Pack 2
MS15-109 Windows Vista x64 Edition Service Pack 2
-
Microsoft Office Remote Code Execution Vulnerabilities (MS15-110)
- Severity
- Critical 4
- Qualys ID
- 110260
- Vendor Reference
- MS15-110
- CVE Reference
- CVE-2015-2555, CVE-2015-2556, CVE-2015-2557, CVE-2015-2558, CVE-2015-6037, CVE-2015-6039
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
Microsoft Office and Sharepoint are prone to the following vulnerabilities:
Remote code execution vulnerabilities exist in Microsoft Office software when the Office software fails to properly handle objects in memory.
An information disclosure vulnerability exists when SharePoint InfoPath Forms Services improperly parses the Document Type Definition (DTD) of an XML file.
A spoofing vulnerability exists when an Office Web Apps Server does not properly sanitize a specially crafted request.
A security feature bypass vulnerability exists in Microsoft SharePoint. The vulnerability is caused when Office Marketplace is allowed to inject JavaScript code that persists onto a SharePoint page, because SharePoint does not enforce the appropriate permission level for an application or user.
The security update addresses the vulnerabilities by:
- Correcting how Office handles objects in memory
- Ensuring that SharePoint InfoPath Forms Services properly handles DTD entities
- Helping to ensure that Office Web Apps Server properly sanitizes web requests
- Modifying the way that SharePoint sanitizes web requestsThis security update is rated Important for all supported editions of Office and Sharepoint.
- Consequence
- The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploits the vulnerabilities could run arbitrary code in the context of the current user.
- Solution
-
Refer to MS15-110 to obtain more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-110 Excel Services on Microsoft SharePoint Server 2007 Service Pack 3 (32-bit editions)
MS15-110 Excel Services on Microsoft SharePoint Server 2007 Service Pack 3 (64-bit editions)
MS15-110 Excel Services on Microsoft SharePoint Server 2010 Service Pack 2
MS15-110 Excel Services on Microsoft SharePoint Server 2013 Service Pack 1
MS15-110 Microsoft Excel 2007 Service Pack 3
MS15-110 Microsoft Excel 2010 Service Pack 2 (32-bit editions)
MS15-110 Microsoft Excel 2010 Service Pack 2 (64-bit editions)
MS15-110 Microsoft Excel 2013 Service Pack 1 (32-bit editions)
MS15-110 Microsoft Excel 2013 Service Pack 1 (64-bit editions)
MS15-110 Microsoft Excel 2016 (32-bit edition)
MS15-110 Microsoft Excel 2016 (64-bit edition)
MS15-110 Microsoft Excel 2016 for Mac
MS15-110 Microsoft Excel Viewer
MS15-110 Microsoft Excel Web App 2010 Service Pack 2
MS15-110 Microsoft Excel for Mac 2011
MS15-110 Microsoft Office Compatibility Pack Service Pack 3
MS15-110 Microsoft Office Web Apps 2010 Service Pack 2
MS15-110 Microsoft Office Web Apps Server 2013 Service Pack 1
MS15-110 Microsoft SharePoint Foundation 2013 Service Pack 1
MS15-110 Microsoft SharePoint Server 2007 Service Pack 3 (32-bit editions)
MS15-110 Microsoft SharePoint Server 2007 Service Pack 3 (64-bit editions)
MS15-110 Microsoft SharePoint Server 2010 Service Pack 2
MS15-110 Microsoft SharePoint Server 2013 Service Pack 1
MS15-110 Microsoft Visio 2007 Service Pack 3
MS15-110 Microsoft Visio 2010 Service Pack 2 (32-bit editions)
MS15-110 Microsoft Visio 2010 Service Pack 2 (64-bit editions)
-
Microsoft Windows Kernel Elevation of Privilege Vulnerabilities (MS15-111)
- Severity
- Serious 3
- Qualys ID
- 91100
- Vendor Reference
- MS15-111
- CVE Reference
- CVE-2015-2549, CVE-2015-2550, CVE-2015-2552, CVE-2015-2553, CVE-2015-2554
- CVSS Scores
- Base 7.2 / Temporal 6
- Description
-
The Windows kernel is the core of the operating system. It provides system-level services such as device management and memory management, allocates processor time to processes, and manages error handling.
Multiple elevation of privilege vulnerabilities exist in the way the Windows kernel handles objects in memory. (CVE-2015-2549, CVE-2015-2550, CVE-2015-2554)
A security feature bypass vulnerability exists when Windows fails to properly enforce the Windows Trusted Boot policy. (CVE-2015-2552)
An elevation of privilege vulnerability exists when Windows improperly validates junctions in certain scenarios. (CVE-2015-2553)Affected Software:
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows 8 for 32-bit Systems
Windows 8 for x64-based Systems
Windows 8.1 for 32-bit Systems
Windows 8.1 for x64-based Systems
Windows Server 2012
Windows Server 2012 R2
Windows RT
Windows RT 8.1
Windows 10 for 32-bit Systems
Windows 10 for x64-based Systems
Windows Server 2008 (CORE) for 32-bit Systems Service Pack 2
Windows Server 2008 (CORE) for x64-based Systems Service Pack 2
Windows Server 2008 R2 (CORE) for x64-based Systems Service Pack 1
Windows Server 2012 (CORE)
Windows Server 2012 R2 (CORE)
This security update is rated Important for all supported releases of Microsoft Windows.
- Consequence
- Successfully exploiting these vulnerabilities might allow an authenticated user to gain escalated privileges.
- Solution
-
Refer to MS15-111 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS15-111 Windows 10 for 32-bit Systems
MS15-111 Windows 10 for x64-based Systems
MS15-111 Windows 7 for 32-bit Systems Service Pack 1
MS15-111 Windows 7 for x64-based Systems Service Pack 1
MS15-111 Windows 8 for 32-bit Systems
MS15-111 Windows 8 for x64-based Systems
MS15-111 Windows 8.1 for 32-bit Systems
MS15-111 Windows 8.1 for x64-based Systems
MS15-111 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS15-111 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-111 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS15-111 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-111 Windows Server 2008 for 32-bit Systems Service Pack 2
MS15-111 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS15-111 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-111 Windows Server 2008 for x64-based Systems Service Pack 2
MS15-111 Windows Server 2012
MS15-111 Windows Server 2012
MS15-111 Windows Server 2012 R2
MS15-111 Windows Server 2012 R2
MS15-111 Windows Vista Service Pack 2
MS15-111 Windows Vista x64 Edition Service Pack 2
These new vulnerability checks are included in Qualys vulnerability signature 2.3.136-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 100259
- 91102
- 91101
- 91099
- 110260
- 91100
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.