Microsoft Security Updates April 2015
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2015-1641 | Memory Corruption RCE in Microsoft Office via Malicious RTF Files Microsoft Office contains a memory corruption flaw (CWE-399) in its handling of Rich Text Format (RTF) files, allowing a crafted RTF document to corrupt memory when the file is parsed. The flaw is triggered by opening a specially crafted RTF file — typically delivered as an email attachment — in an affected version of Microsoft Office. Successful exploitation yields remote code execution in the context of the current user, so attacker privilege is limited to the rights of the logged-in account. Per the CISA data, Microsoft Office is the affected product, with no specific version ranges provided; the flaw was fixed in Microsoft's April 2015 Patch Tuesday security updates (MS15-033), so risk is concentrated on systems that never applied those updates. Exploitation is confirmed in the wild — the CVE was added to the CISA KEV on 2021-11-03 (ransomware use unknown) — it carries a 96.8% EPSS probability of exploitation within 30 days (100th percentile), and related reporting links RTF exploit techniques of this era to targeted APT campaigns (e.g., the T9000 backdoor and DragonOK tooling). Do: Apply Microsoft's April 2015 Office security updates (MS15-033) on all endpoints, per the CISA KEV required action, prioritizing hosts running older Office editions, and verify installation via installed-updates checks. As interim hardening, treat inbound RTF files with suspicion (block or sandbox RTF email attachments) and monitor for suspicious child processes spawned by Word (e.g., Winword.exe launching cmd.exe or PowerShell) to detect possible prior exploitation. Organizations still on legacy Office versions should upgrade to currently supported editions that receive ongoing security updates. | — | 97% | KEV |
| masshundreds of millions of Office installations potentially affected (unpatched subset unknown) |
Full article434 words · extracted from securelist.com · click to collapse
Most RCE in Internet Explorer memory corruption bugs and the Microsoft Office use-after-free
Microsoft releases 11 Security Bulletins (MS15-032 through MS15-042) today, addressing a list of over 25 CVE-identified vulnerabilities for April of 2015. Critical vulnerabilities are fixed in Internet Explorer, Microsoft Office, and the network and graphics stacks. Most of the critical remote code execution (RCE) vulnerabilities reside in the IE memory corruption bugs for all versions of Internet Explorer (6-11) and the Microsoft Office use-after-free. updated: However, they appear to *almost* all be the result of private discoveries, at least, 24 of the 25. In reference to Office vulnerability CVE-2015-1641, “Microsoft is aware of limited attacks that attempt to exploit this vulnerability”.
The Microsoft Office CVE-2015-1649 use-after free is a critical RCE impacting a variety of software and scenarios. The vulnerable code exists across desktop versions Word 2007, 2010, the Word Viewer and Office Compatibility apps, but not Word 2013 or Word for Mac. It’s also critical RCE on the server-side in Word Automation Services on Sharepoint 2010 and Microsoft Office Web Apps Server 2010, but not SharePoint 2013 or Web Apps 2013.
As the new Verizon Data Breach 2015 report highlighted today, many exploits currently effective against targets are exploiting vulnerabilities patched long ago. According to their figures, many of the exploited CVE used on compromised hosts were published over a year prior. Microsoft provides Windows Update to easily keep your software updated, and Kaspersky products provide vulnerability scanners to help keep all of your software up-to-date, including Microsoft’s. Please patch asap.
From the heap of vulnerabilities and fixes rated “Important”, the Hyper-V DoS issue effects the newest Microsoft platform code: Windows 8.1 64-bit and Windows Server 2012 R2 (including the Server Core installation, which is fairly unusual). While the flawed code has not been found to enable EoP on other VMs within the Hyper-V host, attacked Hyper-V systems may lose management of all VMs in the Virtual Machine Manager.
Latest Webinars
Reports
Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.
Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.
Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.
Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/microsoft-security-updates-april-2015/69643/