Microsoft Patch Tuesday for April 2015: 11 Bulletins Released
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2015-1635 | Unauthenticated Remote Code Execution in Microsoft HTTP.sys (MS15-034) CVE-2015-1635 is a remote code execution flaw in HTTP.sys, the kernel-mode HTTP protocol stack component of Microsoft Windows that handles HTTP(S) traffic for IIS and other web-facing Windows roles. A remote, unauthenticated attacker can trigger it by sending specially crafted HTTP requests to a system listening via HTTP.sys, most commonly an internet-facing IIS web server. Successful exploitation yields arbitrary code execution with kernel/system-level privileges on the target server, giving the attacker full control of the host. Any Windows deployment where HTTP.sys is reachable is affected - typically IIS web servers and web-facing roles such as Exchange or WSUS - although the source data does not specify exact version ranges. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-10) with a ~100% EPSS probability of exploitation within 30 days, indicating active exploitation; public proof-of-concept code is not noted in the data and ransomware use is unknown. Do: Apply Microsoft updates per vendor instructions (this CVE is addressed by the April 2015 MS15-034 bulletin) on every Windows system where HTTP.sys is reachable, prioritizing internet-facing IIS, Exchange, and WSUS hosts. Inventory your environment for systems running web-facing Windows roles and, if patching must be delayed, restrict inbound HTTP/80 and HTTPS/443 from untrusted sources or filter malformed HTTP requests at a front-end proxy/WAF. As a CISA KEV entry, this is a required patch for federal agencies; treat it as urgent everywhere else. | — | 100% | KEV |
| masshundreds of thousands of internet-exposed Windows/IIS servers | |
| CVE-2015-1641 | Memory Corruption RCE in Microsoft Office via Malicious RTF Files Microsoft Office contains a memory corruption flaw (CWE-399) in its handling of Rich Text Format (RTF) files, allowing a crafted RTF document to corrupt memory when the file is parsed. The flaw is triggered by opening a specially crafted RTF file — typically delivered as an email attachment — in an affected version of Microsoft Office. Successful exploitation yields remote code execution in the context of the current user, so attacker privilege is limited to the rights of the logged-in account. Per the CISA data, Microsoft Office is the affected product, with no specific version ranges provided; the flaw was fixed in Microsoft's April 2015 Patch Tuesday security updates (MS15-033), so risk is concentrated on systems that never applied those updates. Exploitation is confirmed in the wild — the CVE was added to the CISA KEV on 2021-11-03 (ransomware use unknown) — it carries a 96.8% EPSS probability of exploitation within 30 days (100th percentile), and related reporting links RTF exploit techniques of this era to targeted APT campaigns (e.g., the T9000 backdoor and DragonOK tooling). Do: Apply Microsoft's April 2015 Office security updates (MS15-033) on all endpoints, per the CISA KEV required action, prioritizing hosts running older Office editions, and verify installation via installed-updates checks. As interim hardening, treat inbound RTF files with suspicion (block or sandbox RTF email attachments) and monitor for suspicious child processes spawned by Word (e.g., Winword.exe launching cmd.exe or PowerShell) to detect possible prior exploitation. Organizations still on legacy Office versions should upgrade to currently supported editions that receive ongoing security updates. | — | 97% | KEV |
| masshundreds of millions of Office installations potentially affected (unpatched subset unknown) |
Full article962 words · extracted from blog.talosintelligence.com · click to collapse
Tuesday, April 14, 2015 07:40
Today, Microsoft has released their monthly set of security bulletins designed to address security vulnerabilities within their products. This month’s release sees a total of 11 bulletins being released which address 26 CVEs. The first 4 bulletins are rated Critical and address vulnerabilities within Internet Explorer, Office, IIS, and Graphics Component. The remaining 7 bulletins are rated Important and cover vulnerabilities within SharePoint, Task Scheduler, Windows, XML Core Services, Active Directory, .NET, and Hyper-V.
Bulletins Rated Critical
MS15-032, MS15-033, MS15-034, and MS15-035 are rated Critical.
MS15-032 is this month’s Internet Explorer security bulletin with vulnerabilities in versions 6 through 11 being addressed. This month, 10 CVEs were addressed with the majority of those CVEs being use-after-free vulnerabilities that could result in remote code execution. A couple of information disclosure vulnerabilities were also addressed this month.
MS15-033 addresses 5 vulnerabilities within Microsoft Office, including CVE-2015-1641, which has been publicly disclosed and is currently being exploited. Three of these vulnerabilities (CVE-2015-1649, CVE-2015-1650, CVE-2015-1651) are use-after-free conditions that have been addressed. The other two vulnerabilities (CVE-2015-1639, CVE-2015-1641) are cross-site scripting and memory corruption vulnerabilities that were also addressed.
MS15-034 addresses 1 privately reported vulnerability within Windows IIS. CVE-2015-1635 is a remote code execution vulnerability within the HTTP protocol stack in HTTP.sys, caused by improperly parsing a crafted HTTP request. In order to exploit this vulnerability, an attacker would need to send a maliciously crafted packet containing a malformed HTTP request to the vulnerable server.
MS15-035 addresses CVE-2015-1645, a privately reported vulnerability within the Microsoft Graphics Component affecting Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2. This vulnerability is a remote code execution vulnerability due to Windows failing to parse Enhanced Metafile (EMF) image format files. An attacker can exploit this vulnerability by crafting a malicious web page which includes the maliciously crafted image file or by socially engineering the user to open the crafted image file via some other means, such as email.
Bulletins Rated Important
MS15-036, MS15-037, MS15-038, MS15-039, MS15-040, MS15-041, and MS15-042 are rated Important.
MS15-036 addresses 2 privately reported vulnerabilities within Microsoft Sharepoint Server 2010 SP2 and Microsoft Sharepoint Server 2013 SP1. CVE-2015-1640 and CVE-2015-1653 are cross-site scripting (XSS) vulnerabilities due to SharePoint failing to properly sanitize a specific crafted request to a vulnerable SharePoint server. An attacker could exploit these vulnerabilities by sending a maliciously crafted request to a vulnerable server and perform a XSS attack. An attacker would then be able to have their scripts run in the context of any other user currently logged into the SharePoint site.
MS15-037addresses CVE-2015-0098, a privately reported vulnerability within the Windows Task Scheduler component affecting Windows 7 and Windows Server 2008 R2. This vulnerability is a privilege escalation vulnerability that is due to a known invalid system task being present on certain systems. An authenticated attacker would be able to exploit this vulnerability by checking to see if the invalid task is present on the target system, and then reconfiguring the task to launch an application of the user’s choice. The application that would then be launch would run in the context of the SYSTEM user.
MS15-038 addresses 2 privately reported vulnerabilities affecting all supported versions of Windows. CVE-2015-1643 and CVE-2015-1644 are privilege escalation vulnerabilities where Windows fails to properly enforce impersonation levels. This could allow a user to gain administrator access and perform arbitrary administrative functions, such as adding users and installing applications. An authenticated attacker would be able to exploit these vulnerabilities by crafting and executing an application that would bypass the impersonation level security checks.
MS15-039 addresses CVE-2015-1646, a privately reported vulnerability in Microsoft XML Core Services in Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows 2008 R2. This vulnerability is a same-origin policy violation where cross-domain data access is possible in certain scenarios with a specially crafted XML file. Exploitation of this vulnerability would require a user to open a maliciously crafted XML file via a link to the file on a site or via an email attachment.
MS15-040 addresses CVE-2015-1638, a privately reported vulnerability in Active Directory Federation Services (ADFS). This vulnerability is a information disclosure vulnerability where ADFS fails to properly logout a user. An attacker can potentially exploit this vulnerability by reopening a browser window after it has been closed, and view another user’s information. This vulnerability is only present in Windows Server 2012 R2 and Windows Server 2012 R2 Server Core.
MS15-041 addresses CVE-2015-1648, a privately reported vulnerability within the .NET framework. This vulnerability is a information disclosure vulnerability that can potentially be exploited if an attacker sends a maliciously crafted web request to a vulnerable server. An attacker who is able to successfully exploit this vulnerability would be able to view parts of the web configuration file, which could expose sensitive information.
MS15-042 addresses CVE-2015-1647, a privately reported vulnerability within Windows Hyper-V. This vulnerability is a denial of service vulnerability that can potentially be exploited by an authenticated attacker who runs a maliciously crafted application within a virtual machine on a Hyper-V host. As a result, this can potentially cause other virtual machines running on the same host to not be manageable via the Virtual Machine Manager. Remote code execution or privilege escalation are not possible with this vulnerability.
Coverage
In response to these bulletin disclosures, Talos is releasing the following rules to address these vulnerabilities. Please note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Defense Center, FireSIGHT Management Center or Snort.org.
Snort SIDs: 34059-34099
Related Links: Event Response Page
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/microsoft-patch-tuesday-for-april-2015/