Microsoft Patch Tuesday
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-0021 | Microsoft InfoPath 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memor Microsoft InfoPath 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." NVD description · AI analysis pending | 7.8 | 24% |
| — | ||
| CVE-2016-0134 +1 in the same advisory: …0057 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, and Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." NVD description · AI analysis pending | 7.8 | 21% |
| — | ||
| CVE-2016-0087 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 do not properly validate handles, which allows local users to gain privileges Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 do not properly validate handles, which allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability." NVD description · AI analysis pending | 7.8 | 2% |
| — | ||
| CVE-2016-0121 | The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability." NVD description · AI analysis pending | 8.8 group max | 41% |
| — | ||
| CVE-2016-0099 | Local Privilege Escalation in Microsoft Windows Secondary Logon Service CVE-2016-0099 is a privilege escalation flaw in the Windows Secondary Logon Service, which fails to properly manage request handles in memory. An attacker who can already execute code on a vulnerable Windows system triggers the flaw through the service's request handling and gains the ability to run arbitrary code as administrator, converting a low-privilege foothold into full system control. Microsoft Windows systems lacking the vendor's updates are affected; the CISA data lists the impacted product only as 'Microsoft Windows' without specific version ranges. Exploitation is confirmed in the wild: CISA added the bug to its Known Exploited Vulnerabilities catalog on 2022-03-03 with known ransomware use, and EPSS places the 30-day exploitation probability at 37.2% (98th percentile). No public proof-of-concept is cataloged in the source data. Do: Apply Microsoft's March 2016 security updates (MS16-032) on all Windows systems, per the vendor instructions required by the CISA KEV entry, prioritizing legacy and internet-reachable hosts. On systems that cannot be patched, disable the Secondary Logon service as a mitigation (noting that 'Run as' will stop working), and hunt for local privilege-escalation and ransomware-staging activity on unpatched Windows machines. | 7.8 | 37% | KEV ransomware PoC ×4 |
| massOn the order of millions of unpatched Windows systems (Windows runs on >1 billion active devices; only machines missing the March 2016 updates remain… | |
| CVE-2016-0100 | Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Library L Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Library Loading Input Validation Remote Code Execution Vulnerability." NVD description · AI analysis pending | 8.4 | 58% |
| — | ||
| CVE-2016-0132 | Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandles signature validation for unspecified elements of XML documents, which al Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandles signature validation for unspecified elements of XML documents, which allows remote attackers to spoof signatures via a modified document, aka ".NET XML Validation Security Feature Bypass." NVD description · AI analysis pending | 9.8 | 22% |
| — |
Full article1,118 words · extracted from blog.talosintelligence.com · click to collapse
Tuesday, March 8, 2016 15:00
Patch Tuesday for March 2016 has arrived. Today, Microsoft has released their monthly set of security bulletins designed to address security vulnerabilities within their products. This month’s release contains 13 bulletins addressing 44 vulnerabilities. Five bulletins are rated critical and address vulnerabilities in Edge, Graphic Fonts, Internet Explorer, Windows Media Player, and Window PDF. The remaining eight bulletins are rated important and address vulnerabilities in .NET, Office, and several other Windows components.
Bulletins Rated Critical Microsoft bulletins MS16-023, MS16-024, MS16-026 through MS16-028, and MS16-036 are rated as critical in this month's release.
MS16-023 and MS16-024 are this month's Internet Explorer and Edge security bulletin respectively. In total, 24 vulnerabilities between the two bulletins were addressed with five vulnerabilities in common (meaning that both Edge and IE are affected by the same five vulnerabilities). The IE security bulletin addresses 13 memory corruption vulnerabilities while the Edge bulletin addresses 10 memory corruption flaws and one information disclosure bug that manifests as a result of Edge improperly handling referrer policy, potentially leaking the user's request content or browsing history.
MS16-026 addresses two privately reported vulnerabilities in the Windows Adobe Type Manager Library. The most severe vulnerability of the two, CVE-2016-0121, is a remote code execution vulnerability while the other vulnerability, CVE-2016-0120, is considered moderate due to it being a denial of service flaw. Both vulnerabilities manifest as a failure to correctly parse OpenType fonts. Exploitation of these two vulnerabilities is achievable if a user opens a specifically crafted document, or if they navigate to a webpage containing specifically crafted embedded OpenType fonts. Note that workarounds to help reduce the risk of an attacker exploiting these vulnerabilities are available. For more information, please refer to the security bulletin.
MS16-027 addresses two critical vulnerabilities in Windows Media Player. Both CVE-2016-0101 and CVE-2016-0098 are remote code execution vulnerabilities that manifest as a result of improperly parsing media content. Exploitation of these vulnerabilities is achievable if, for example, an attacker embeds specifically crafted media content on a website that a user navigates to.
MS16-028 addresses two vulnerabilities in the Windows PDF Library that could lead to arbitrary code execution. CVE-2016-0117 and CVE-2016-0118 both manifest as a flaw in how the library parses a PDF file. Exploitation of these two vulnerabilities is achievable if a user were to open a specifically crafted PDF file. Note that any arbitrary code execution as a result of exploiting one of these two vulnerabilities would be limited to the context of the current user.
MS16-036 is the Adobe Flash Player security bulletin for Windows and is designed to address security defects in Flash Player. Addition details cover what vulnerabilities were addressed can be found by reviewing the security bulletin, APSB16-08, which is posted on the Adobe Product Security portal.
Bulletins Rated Important Microsoft bulletins MS16-025, and MS16-029 through MS16-035 are rated as important in this month's release.
MS16-025 addresses CVE-2016-0100, which is a arbitrary code execution vulnerability resulting from an input validation flaw during library loading. This vulnerability manifests when Windows fails to properly validate and sanitize input before loading certain libraries. An authenticated attacker who executes a maliciously crafted application that exploits this vulnerability would then be able to execute arbitrary code in the context of the current user. Note that this vulnerability only impacts Windows Vista Service Pack 2 and Windows 2008 Service Pack 2 (not Server 2008 R2).
MS16-029 is this month's Office security bulletin which addresses three privately reported vulnerabilities. Two the vulnerabilities (CVE-2016-0021 and CVE-2016-0134) are memory corruption vulnerabilities that manifest as a result of improperly parsing an Office document file and could lead to arbitrary code execution. The third vulnerability, CVE-2016-0057, is a security feature bypass that manifests due to an Office binary being improperly signed. Exploitation of CVE-2016-0057 is achievable if an attacker has write privileges to where the invalidly signed binary resides and overwrites the invalidly signed binary with one that contains malicious code.
MS16-030 addresses two privately reported vulnerabilities in Windows Object Linking and Embedded (OLE). CVE-2016-0091/0092 are both arbitrary code execution vulnerabilities that manifest as a result of Windows OLE failing to properly validate and sanitize input. Exploitation of these two vulnerabilities is achievable if a user executes a maliciously crafted application, leading to addition arbitrary code executing in the context of the current user.
MS16-031 addresses CVE-2016-0087, a privately reported privilege escalation flaw within Windows. CVE-2016-0087 manifests as a result of Windows failing to properly validate and enforce user impersonation levels. Exploitation of this vulnerability is achievable if an authenticated attacker executes a specifically written application that exploits this flaw. Note that only Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 are affected.
MS16-032 addresses CVE-2016-0099, a privately reported privilege escalation vulnerability in the Windows Secondary Logon Service. CVE-2016-0099 manifests as a failure by the Windows Secondary Logon Service to handle requests in memory. As a result, an authenticated attacker who executes a specifically crafted executable that is designed to exploit this flaw could obtain administrative privileges on the targeted system.
MS16-033 addresses CVE-2016-0133, a privately reported privilege escalation vulnerability in the Windows USB Mass Storage Class driver. CVE-2016-0133 manifests as a result of the USB Mass Storage Class driver failing to validate and handle objects in memory. In order for this vulnerability to be exploited, an attacker would need to have physical access to the system. An attacker could then insert a maliciously crafted USB device that exploits this vulnerability and execute arbitrary code in kernel mode.
MS16-034 addresses four privately reported privilege escalation vulnerabilities within Win32k. CVE-2016-0093 through CVE-2016-0096 all manifest as a result of the Kernel Mode Driver failing to properly handle objects in memory. Exploitation of these vulnerabilities could allow an attacker to execute arbitrary code in kernel mode. Note that for exploitation to be successful, an attacker would need to be authenticated and execute a specifically written application that exploits one of these flaws.
MS16-035 addresses CVE-2016-0132, a privately reported security feature bypass vulnerability in the .NET Framework. CVE-2016-0132 manifests as a failure to properly validate certain elements within a signed XML document. As a result, an attacker who exploits this vulnerability would be able to modify the contents of an XML file without invalidating the file's signature.
Coverage
In response to these bulletin disclosures, Talos is releasing the following rules to address these vulnerabilities. Please note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Defense Center, FireSIGHT Management Center or Snort.org.
Snort Rules:
- Rules for Microsoft Bulletins: 38061-38086, 38088-38101, 38106-38115, 38117-38120, 38122-38123
- Rules for Adobe Flash Player Bulletin: 38165-38170, 38173-38227
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/ms-tuesday-63063210e63ef5e7e1ec3159/