Microsoft security alert.
June 14, 2016
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 40 vulnerabilities that were fixed in 16 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 16 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Windows Graphics Component Multiple Vulnerabilities (MS16-074)
- Severity
- Critical 4
- Qualys ID
- 91237
- Vendor Reference
- MS16-074
- CVE Reference
- CVE-2016-3216, CVE-2016-3219, CVE-2016-3220
- CVSS Scores
- Base 6.9 / Temporal 5.7
- Description
-
Microsoft Windows Graphics Component is prone to multiple vulnerabilities that could lead to information disclosure or privilege escalation attacks.
The security update addresses the vulnerabilities by correcting how:
- The Windows Graphics Component (GDI32.dll) handles objects in memory
- The Windows kernel-mode driver (Win32k.sys) handles objects in memory and helps to prevent unintended elevation of privilege from user-mode
- The Adobe Type Manager Font Driver (ATMFD.dll) handles objects in memory
This security update is rated Important for all supported releases of Microsoft Windows.
- Consequence
- The most severe of the vulnerabilities could allow elevation of privilege if a user opens a specially crafted document or visits a specially crafted website.
- Solution
-
Refer to MS16-074 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-074 Windows 10 Version 1511 for 32-bit Systems
MS16-074 Windows 10 Version 1511 for x64-based Systems
MS16-074 Windows 10 for 32-bit Systems
MS16-074 Windows 10 for x64-based Systems
MS16-074 Windows 7 for 32-bit Systems Service Pack 1
MS16-074 Windows 7 for 32-bit Systems Service Pack 1
MS16-074 Windows 7 for x64-based Systems Service Pack 1
MS16-074 Windows 7 for x64-based Systems Service Pack 1
MS16-074 Windows 8.1 for 32-bit Systems
MS16-074 Windows 8.1 for 32-bit Systems
MS16-074 Windows 8.1 for x64-based Systems
MS16-074 Windows 8.1 for x64-based Systems
MS16-074 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS16-074 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS16-074 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS16-074 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS16-074 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS16-074 Windows Server 2008 for 32-bit Systems Service Pack 2
MS16-074 Windows Server 2008 for 32-bit Systems Service Pack 2
MS16-074 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS16-074 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS16-074 Windows Server 2008 for x64-based Systems Service Pack 2
MS16-074 Windows Server 2008 for x64-based Systems Service Pack 2
MS16-074 Windows Server 2012
MS16-074 Windows Server 2012
MS16-074 Windows Server 2012 R2
MS16-074 Windows Server 2012 R2
MS16-074 Windows Vista Service Pack 2
MS16-074 Windows Vista Service Pack 2
MS16-074 Windows Vista x64 Edition Service Pack 2
MS16-074 Windows Vista x64 Edition Service Pack 2
-
Microsoft Cumulative Security Update for Internet Explorer (MS16-063)
- Severity
- Critical 4
- Qualys ID
- 100288
- Vendor Reference
- MS16-063
- CVE Reference
- CVE-2016-0199, CVE-2016-0200, CVE-2016-3202, CVE-2016-3205, CVE-2016-3206, CVE-2016-3207, CVE-2016-3210, CVE-2016-3211, CVE-2016-3212, CVE-2016-3213
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft Internet Explorer is a graphical web browser developed by Microsoft and included as part of the Microsoft Windows operating systems.
This security update resolves multiple vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer.
This security update is rated Critical for Internet Explorer 9 (IE 9), and Internet Explorer 11 (IE 11) on affected Windows clients, and Moderate for Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows servers.
- Consequence
- The most severe vulnerabilities could allow remote code execution if a user views a specially crafted web page using Internet Explorer. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the logged-on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
- Solution
-
Customers are advised to refer to Microsoft Advisory MS16-063 for more details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-063 Windows 10 Version 1511 for 32-bit Systems
MS16-063 Windows 10 Version 1511 for x64-based Systems
MS16-063 Windows 10 for 32-bit Systems
MS16-063 Windows 10 for x64-based Systems
MS16-063 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 11)
MS16-063 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 11)
MS16-063 Windows 8.1 for 32-bit Systems(Internet Explorer 11)
MS16-063 Windows 8.1 for x64-based Systems(Internet Explorer 11)
MS16-063 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 11)
MS16-063 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 9)
MS16-063 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 9)
MS16-063 Windows Server 2012(Internet Explorer 10)
MS16-063 Windows Server 2012 R2(Internet Explorer 11)
MS16-063 Windows Vista Service Pack 2(Internet Explorer 9)
MS16-063 Windows Vista x64 Edition Service Pack 2(Internet Explorer 9)
-
Microsoft Edge Cumulative Security Update (MS16-068)
- Severity
- Critical 4
- Qualys ID
- 91233
- Vendor Reference
- MS16-068
- CVE Reference
- CVE-2016-3198, CVE-2016-3199, CVE-2016-3201, CVE-2016-3202, CVE-2016-3203, CVE-2016-3214, CVE-2016-3215, CVE-2016-3222
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft Edge is a web browser developed by Microsoft and included in the company's Windows 10 operating systems, replacing Internet Explorer as the default web browser on all device classes.
This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow code execution with elevated privileges if a user views a specially crafted webpage using Microsoft Edge.
This security update is rated critical for Microsoft Edge on Windows 10.
- Consequence
- An attacker who has successfully exploited the vulnerabilities could gain the same user rights as the current user.
- Solution
-
Customers are advised to refer to Microsoft Security Bulletin MS16-068 for details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-068 Windows 10 Version 1511 for 32-bit Systems
MS16-068 Windows 10 Version 1511 for x64-based Systems
MS16-068 Windows 10 for 32-bit Systems
MS16-068 Windows 10 for x64-based Systems
-
Microsoft JScript and VBScript Remote Code Execution Vulnerabilities (MS16-069)
- Severity
- Critical 4
- Qualys ID
- 91234
- Vendor Reference
- MS16-069
- CVE Reference
- CVE-2016-3205, CVE-2016-3206, CVE-2016-3207
- CVSS Scores
- Base 7.6 / Temporal 6.3
- Description
-
This security update resolves a vulnerability in the VBScript scripting engine in Microsoft Windows.
A remote code execution vulnerability exists in the way that the VBScript engine renders when handling objects in memory in Internet Explorer. The update addresses the vulnerability by modifying how the VBScript scripting engine handles objects in memory.This security update is rated Critical for affected versions of the VBScript scripting engine on supported editions of Windows Vista, Windows Server 2008, and Server Core installations of Windows Server 2008 R2.
- Consequence
- The vulnerability could allow remote code execution if a user visits a specially crafted website. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user.
- Solution
-
Please refer to MS16-069 for details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-069 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Server Core installation)(JScript 5.8 and VBScript 5.8)
MS16-069 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)(VBScript 5.7)
MS16-069 Windows Server 2008 for Itanium-based Systems Service Pack 2(VBScript 5.7)
MS16-069 Windows Server 2008 for x32-bit Systems Service Pack 2(VBScript 5.7)
MS16-069 Windows Server 2008 for x64-based Systems Service Pack 2(VBScript 5.7)
MS16-069 Windows Server 2008 for x64-based Systems Service Pack 2(Server Core installation)(VBScript 5.7)
MS16-069 Windows Vista Service Pack 2(VBScript 5.7)
MS16-069 Windows Vista x64 Edition Service Pack 2(VBScript 5.7)
-
Microsoft Office Remote Code Execution Vulnerabilities (MS16-070)
- Severity
- Urgent 5
- Qualys ID
- 110273
- Vendor Reference
- MS16-070
- CVE Reference
- CVE-2016-0025, CVE-2016-3233, CVE-2016-3234, CVE-2016-3235
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft is prone to multiple vulnerabilities that could result in memory corruption, information disclosure or allow OLE Side DDL Loading.
Microsoft has released a security update that addresses the vulnerabilities by correcting how:
Office handles objects in memory
Certain functions handle objects in memory
Windows validates input before loading libraries
- Consequence
- The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
- Solution
-
Refer to MS16-070 obtain more information.
Workaround:
1) Use Microsoft Office File Block policy to prevent Office from opening RTF documents from unknown or untrusted sourcesImpact of workaround #1: Users who have configured the File Block policy and have not configured a special "exempt directory" as discussed in Microsoft Knowledge Base Article 922849 will be unable to open documents saved in the RTF format.
2) Prevent Word from loading RTF files
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-070 Microsoft Excel 2007 Service Pack 3
MS16-070 Microsoft Excel 2010 Service Pack 2 (32-bit editions)
MS16-070 Microsoft Excel 2010 Service Pack 2 (64-bit editions)
MS16-070 Microsoft Office 2010 Service Pack 2 (32-bit editions)
MS16-070 Microsoft Office 2010 Service Pack 2 (64-bit editions)
MS16-070 Microsoft Office 2016 (32-bit edition)
MS16-070 Microsoft Office 2016 (64-bit edition)
MS16-070 Microsoft Office Compatibility Pack Service Pack 3
MS16-070 Microsoft Office Compatibility Pack Service Pack 3
MS16-070 Microsoft Office OneNote 2016 (32-bit edition)
MS16-070 Microsoft Office OneNote 2016 (64-bit edition)
MS16-070 Microsoft Office Web Apps 2010 Service Pack 2
MS16-070 Microsoft Office Web Apps Server 2013 Service Pack 1
MS16-070 Microsoft Visio 2007 Service Pack 3
MS16-070 Microsoft Visio 2010 Service Pack 2 (32-bit editions)
MS16-070 Microsoft Visio 2010 Service Pack 2 (64-bit editions)
MS16-070 Microsoft Visio 2013 Service Pack 1 (32-bit editions)
MS16-070 Microsoft Visio 2013 Service Pack 1 (64-bit editions)
MS16-070 Microsoft Visio 2016 (32-bit edition)
MS16-070 Microsoft Visio 2016 (64-bit edition)
MS16-070 Microsoft Visio Viewer 2007 Service Pack 3
MS16-070 Microsoft Visio Viewer 2010 (32-bit Edition)
MS16-070 Microsoft Visio Viewer 2010 (64-bit Edition)
MS16-070 Microsoft Word 2007 Service Pack 3
MS16-070 Microsoft Word 2010 Service Pack 2 (32-bit editions)
MS16-070 Microsoft Word 2010 Service Pack 2 (64-bit editions)
MS16-070 Microsoft Word 2013 Service Pack 1 (32-bit editions)
MS16-070 Microsoft Word 2013 Service Pack 1 (64-bit editions)
MS16-070 Microsoft Word 2016 (32-bit edition)
MS16-070 Microsoft Word 2016 (64-bit edition)
MS16-070 Microsoft Word 2016 for Mac
MS16-070 Microsoft Word Viewer
MS16-070 Microsoft Word for Mac 2011
MS16-070 Office Online Server
MS16-070 Word Automation Services on Microsoft SharePoint Server 2010 Service Pack 2
MS16-070 Word Automation Services on Microsoft SharePoint Server 2013 Service Pack 1
-
Microsoft Windows DNS Server Remote Code Execution Vulnerability (MS16-071)
- Severity
- Urgent 5
- Qualys ID
- 91239
- Vendor Reference
- MS16-071
- CVE Reference
- CVE-2016-3227
- CVSS Scores
- Base 10 / Temporal 7.4
- Description
-
Microsoft Windows DNS server is vulnerable to a remote code execution issue due to failing to properly parse requests.
Windows 2012 servers that are configured as DNS servers are at risk from this vulnerability.
This security update is rated Critical for all supported editions of Windows Server 2012.
- Consequence
-
Successful exploitation allows an attacker to execute arbitrary code.
- Solution
-
Refer to MS16-071 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-071 Windows Server 2012(DNS)
MS16-071 Windows Server 2012 (Server Core installation)(DNS)
MS16-071 Windows Server 2012 R2(DNS)
MS16-071 Windows Server 2012 R2 (Server Core installation)(DNS)
-
Microsoft Windows Group Policy Elevation of Privilege Vulnerability (MS16-072)
- Severity
- Critical 4
- Qualys ID
- 91240
- Vendor Reference
- MS16-072
- CVE Reference
- CVE-2016-3223
- CVSS Scores
- Base 9.3 / Temporal 7.3
- Description
-
An elevation of privilege vulnerability exists when Microsoft Windows processes group policy updates.
The security update addresses the vulnerability by enforcing Kerberos authentication for certain calls over LDAP.
This security update is rated Important for all supported releases of Microsoft Windows.
- Consequence
-
Successful exploitation allows an attacker to could potentially escalate permissions or perform additional privileged actions on the target machine.
- Solution
-
Refer to MS16-072 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-072 Windows 10 Version 1511 for 32-bit Systems
MS16-072 Windows 10 Version 1511 for x64-based Systems
MS16-072 Windows 10 for 32-bit Systems
MS16-072 Windows 10 for x64-based Systems
MS16-072 Windows 7 for 32-bit Systems Service Pack 1
MS16-072 Windows 7 for x64-based Systems Service Pack 1
MS16-072 Windows 8.1 for 32-bit Systems
MS16-072 Windows 8.1 for x64-based Systems
MS16-072 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS16-072 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS16-072 Windows Server 2008 for 32-bit Systems Service Pack 2
MS16-072 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS16-072 Windows Server 2008 for x64-based Systems Service Pack 2
MS16-072 Windows Server 2012
MS16-072 Windows Server 2012 R2
MS16-072 Windows Vista Service Pack 2
MS16-072 Windows Vista x64 Edition Service Pack 2
-
Microsoft Windows Kernel Mode Drivers Elevation of Privilege Vulnerabilities (MS16-073)
- Severity
- Critical 4
- Qualys ID
- 91236
- Vendor Reference
- MS16-073
- CVE Reference
- CVE-2016-3218, CVE-2016-3221, CVE-2016-3232
- CVSS Scores
- Base 6.9 / Temporal 5.1
- Description
-
Microsoft Kernel Mode Drivers are prone to multiple privilege escalation vulnerabilities affecting Win32K. Windows Virtual PCI is also prone to an information disclosure vulnerability.
Microsoft has released a security update that addresses the vulnerabilities by correcting how the Windows kernel-mode driver handles objects in memory, and by correcting VPCI memory handling.
This security update is rated Important for all supported releases of Microsoft Windows.
- Consequence
- This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application.
- Solution
-
Refer to MS16-073 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-073 Windows 10 Version 1511 for 32-bit Systems
MS16-073 Windows 10 Version 1511 for x64-based Systems
MS16-073 Windows 10 for 32-bit Systems
MS16-073 Windows 10 for x64-based Systems
MS16-073 Windows 7 for 32-bit Systems Service Pack 1
MS16-073 Windows 7 for x64-based Systems Service Pack 1
MS16-073 Windows 8.1 for 32-bit Systems
MS16-073 Windows 8.1 for x64-based Systems
MS16-073 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS16-073 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS16-073 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS16-073 Windows Server 2008 for 32-bit Systems Service Pack 2
MS16-073 Windows Server 2008 for 32-bit Systems Service Pack 2
MS16-073 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS16-073 Windows Server 2008 for x64-based Systems Service Pack 2
MS16-073 Windows Server 2012
MS16-073 Windows Server 2012
MS16-073 Windows Server 2012
MS16-073 Windows Server 2012 R2
MS16-073 Windows Server 2012 R2
MS16-073 Windows Server 2012 R2
MS16-073 Windows Vista Service Pack 2
MS16-073 Windows Vista x64 Edition Service Pack 2
-
Microsoft Windows SMB Server Elevation of Privilege Vulnerability (MS16-075)
- Severity
- Critical 4
- Qualys ID
- 91238
- Vendor Reference
- MS16-075
- CVE Reference
- CVE-2016-3225
- CVSS Scores
- Base 6.9 / Temporal 5.7
- Description
-
Microsoft Server Message Block (SMB) Protocol is a Microsoft network file sharing protocol used in Microsoft Windows.
An elevation of privilege vulnerability exists in the Microsoft Server Message Block (SMB) when an attacker forwards an authentication request intended for another service running on the same machine.
This security update is rated Important for all supported editions of Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1 and Windows 10.
- Consequence
-
Successfully exploiting this vulnerability might allow a local attacker to execute arbitrary code.
- Solution
-
Customers are advised to refer to Microsoft Advisory MS16-075 for more details.
Workaround:
Enable Extended Protection for Authentication (EPA) for SMB server.Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-075 Windows 10 Version 1511 for 32-bit Systems
MS16-075 Windows 10 Version 1511 for x64-based Systems
MS16-075 Windows 10 for 32-bit Systems
MS16-075 Windows 10 for x64-based Systems
MS16-075 Windows 7 for 32-bit Systems Service Pack 1
MS16-075 Windows 7 for x64-based Systems Service Pack 1
MS16-075 Windows 8.1 for 32-bit Systems
MS16-075 Windows 8.1 for x64-based Systems
MS16-075 Windows RT 8.1
MS16-075 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS16-075 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS16-075 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS16-075 Windows Server 2008 for 32-bit Systems Service Pack 2
MS16-075 Windows Server 2008 for 32-bit Systems Service Pack 2
MS16-075 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS16-075 Windows Server 2008 for x64-based Systems Service Pack 2
MS16-075 Windows Server 2008 for x64-based Systems Service Pack 2
MS16-075 Windows Server 2012
MS16-075 Windows Server 2012
MS16-075 Windows Server 2012 R2
MS16-075 Windows Server 2012 R2
MS16-075 Windows Vista Service Pack 2
MS16-075 Windows Vista x64 Edition Service Pack 2
-
Microsoft Windows Netlogon Memory Corruption Vulnerability (MS16-076)
- Severity
- Serious 3
- Qualys ID
- 91231
- Vendor Reference
- MS16-076
- CVE Reference
- CVE-2016-3228
- CVSS Scores
- Base 9 / Temporal 6.7
- Description
-
This security update resolves a vulnerability in Microsoft Windows.
The update addresses the vulnerability by modifying how Netlogon handles the establishment of secure channels. This update corrects how Windows handles objects in memory to prevent corruption.
This security update is rated Important for all supported editions of Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2. - Consequence
- The vulnerability could allow remote code execution if an attacker with access to a domain controller (DC) on a target network runs a specially crafted application to establish a secure channel to the DC as a replica domain controller.
- Solution
-
Refer to Microsoft Security Bulletin MS16-076 for further details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-076 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS16-076 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS16-076 Windows Server 2008 for 32-bit Systems Service Pack 2
MS16-076 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS16-076 Windows Server 2008 for x64-based Systems Service Pack 2
MS16-076 Windows Server 2012
MS16-076 Windows Server 2012
MS16-076 Windows Server 2012 R2
MS16-076 Windows Server 2012 R2
-
Microsoft Web Proxy Auto Discovery (WPAD) Elevation of Privilege Vulnerability (MS16-077)
- Severity
- Critical 4
- Qualys ID
- 91229
- Vendor Reference
- MS16-077
- CVE Reference
- CVE-2016-3213, CVE-2016-3236, CVE-2016-3299
- CVSS Scores
- Base 10 / Temporal 7.8
- Description
-
WPAD is a protocol used to ensure all systems in an organization use the same web proxy configuration. Instead of individually modifying configurations on each device connected to a network, WPAD locates a proxy configuration file and applies the configuration automatically.
The update addresses the vulnerabilities by correcting how Windows handles proxy discovery, and WPAD automatic proxy detection in Windows. Affected Versions:-
This security update is rated Important for all supported releases of Microsoft Windows. - Consequence
- The vulnerabilities could allow elevation of privilege if the Web Proxy Auto Discovery (WPAD) protocol falls back to a vulnerable proxy discovery process on a target system.
- Solution
-
Refer to MS16-077 for further details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-077 Windows 10 Version 1511 for 32-bit Systems
MS16-077 Windows 10 Version 1511 for x64-based Systems
MS16-077 Windows 10 for 32-bit Systems
MS16-077 Windows 10 for x64-based Systems
MS16-077 Windows 7 for 32-bit Systems Service Pack 1
MS16-077 Windows 7 for x64-based Systems Service Pack 1
MS16-077 Windows 8.1 for 32-bit Systems
MS16-077 Windows 8.1 for x64-based Systems
MS16-077 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS16-077 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS16-077 Windows Server 2008 for 32-bit Systems Service Pack 2
MS16-077 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS16-077 Windows Server 2008 for x64-based Systems Service Pack 2
MS16-077 Windows Server 2012
MS16-077 Windows Server 2012 R2
MS16-077 Windows Vista Service Pack 2
MS16-077 Windows Vista x64 Edition Service Pack 2
-
Microsoft Windows Diagnostics Hub Elevation of Privilege Vulnerability (MS16-078)
- Severity
- Serious 3
- Qualys ID
- 91241
- Vendor Reference
- MS16-078
- CVE Reference
- CVE-2016-3231
- CVSS Scores
- Base 7.2 / Temporal 5.6
- Description
-
An elevation of privilege vulnerability exists when the Windows Diagnostics Hub Standard Collector Service fails to properly sanitize input, leading to an insecure library loading behavior.
The security update addresses the vulnerability by correcting how the Windows Diagnostics Hub Standard Collector Service sanitizes input.
This security update is rated Important for all supported editions of Microsoft Windows 10
- Consequence
-
Successful exploitation allows an attacker to execute arbitrary code with elevated system privileges.
- Solution
-
Refer to MS16-078 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-078 Windows 10 Version 1511 for 32-bit Systems
MS16-078 Windows 10 Version 1511 for x64-based Systems
MS16-078 Windows 10 for 32-bit Systems
MS16-078 Windows 10 for x64-based Systems
-
Microsoft Exchange Server Address Multiple Vulnerabilities (MS16-079)
- Severity
- Serious 3
- Qualys ID
- 53004
- Vendor Reference
- MS16-079
- CVE Reference
- CVE-2015-6013, CVE-2015-6014, CVE-2015-6015, CVE-2016-0028
- CVSS Scores
- Base 10 / Temporal 7.4
- Description
-
This security update resolves vulnerabilites in Microsoft Exchange Server. The most severe of the vulnerabilities could allow information disclosure if an attacker sends a specially crafted image URL in an Outlook Web Access (OWA) message that is loaded, without warning or filtering, from the attacker-controlled URL.
The security update addresses the vulnerabilities by correcting the way that Microsoft Exchange parses HTML messages.
This security update is rated Important for all supported editions of Microsoft Exchange Server 2007, Microsoft Exchange Server 2010, Microsoft Exchange Server 2013, and Microsoft Exchange Server 2016.
- Consequence
-
Successful exploitation allows an attacker to identify, fingerprint, and track a user online.
- Solution
-
Please refer to MS16-079 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-079 Microsoft Exchange Server 2007 Service Pack 3
MS16-079 Microsoft Exchange Server 2010 Service Pack 3
MS16-079 Microsoft Exchange Server 2013 Cumulative Update 11
MS16-079 Microsoft Exchange Server 2013 Cumulative Update 12
MS16-079 Microsoft Exchange Server 2013 Service Pack 1
MS16-079 Microsoft Exchange Server 2016
MS16-079 Microsoft Exchange Server 2016 Cumulative Update 1
-
Microsoft Windows PDF Library Remote Code Execution Vulnerability (MS16-080)
- Severity
- Critical 4
- Qualys ID
- 91230
- Vendor Reference
- MS16-080
- CVE Reference
- CVE-2016-3201, CVE-2016-3203, CVE-2016-3215
- CVSS Scores
- Base 9.3 / Temporal 7.3
- Description
-
This security update resolves vulnerabilities in Microsoft Windows.
The update addresses the vulnerabilities by modifying how Windows parses .pdf files.
This security update is rated Important for all supported editions of Windows 8.1, Windows Server 2012, Windows Server 2012 R2, and Windows 10. - Consequence
- The more severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted .pdf file. An attacker who successfully exploited the vulnerabilities could cause arbitrary code to execute in the context of the current user. However, an attacker would have no way to force a user to open a specially crafted .pdf file.
- Solution
-
Refer to MS16-080 to obtain more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-080 Windows 10 Version 1511 for 32-bit Systems
MS16-080 Windows 10 Version 1511 for x64-based Systems
MS16-080 Windows 10 for 32-bit Systems
MS16-080 Windows 10 for x64-based Systems
MS16-080 Windows 8.1 for 32-bit Systems
MS16-080 Windows 8.1 for x64-based Systems
MS16-080 Windows Server 2012
MS16-080 Windows Server 2012 R2
-
Microsoft Active Directory Denial of Service Vulnerability (MS16-081)
- Severity
- Serious 3
- Qualys ID
- 91232
- Vendor Reference
- MS16-081
- CVE Reference
- CVE-2016-3226
- CVSS Scores
- Base 4 / Temporal 3
- Description
-
Active Directory Services contains an extensible and scalable set of services that enables you to efficiently manage corporate identities, credentials, information protection, and system and application settings.
A denial of service vulnerability exists in Active Directory when an authenticated attacker creates multiple machine accounts.
This security update is rated Important.
Affected Versions:
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2012
Windows Server 2012 R2
- Consequence
- An attacker could exploit this vulnerability by creating multiple machine accounts, resulting in denial of service.
- Solution
-
Refer to MS16-081 for further information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-081 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS16-081 Windows Server 2012
MS16-081 Windows Server 2012 R2
-
Microsoft Windows Search Component Denial of Service Vulnerability (MS16-082)
- Severity
- Serious 3
- Qualys ID
- 91235
- Vendor Reference
- MS16-082
- CVE Reference
- CVE-2016-3230
- CVSS Scores
- Base 1.9 / Temporal 1.4
- Description
-
This security update resolves a vulnerability in Microsoft Windows. A denial of service vulnerability exists in the Windows search component.
This vulnerability occurs when the Windows Search component fails to properly handle certain objects in memory.
This security update is rated Important.
- Consequence
- Successful exploitation allows attacker to cause denial of service and disrupt server availability.
- Solution
-
Refer to MS16-082 for further information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-082 Windows 10 Version 1511 for 32-bit Systems
MS16-082 Windows 10 Version 1511 for x64-based Systems
MS16-082 Windows 10 for 32-bit Systems
MS16-082 Windows 10 for x64-based Systems
MS16-082 Windows 7 for 32-bit Systems Service Pack 1
MS16-082 Windows 7 for x64-based Systems Service Pack 1
MS16-082 Windows 8.1 for 32-bit Systems
MS16-082 Windows 8.1 for x64-based Systems
MS16-082 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS16-082 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS16-082 Windows Server 2012
MS16-082 Windows Server 2012 R2
These new vulnerability checks are included in Qualys vulnerability signature 2.3.346-7. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 91237
- 100288
- 91233
- 91234
- 110273
- 91239
- 91240
- 91236
- 91238
- 91231
- 91229
- 91241
- 53004
- 91230
- 91232
- 91235
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.