Patch Tuesday Analysis - August 2015

Editor's Notes

• #5: 2 public disclosures (across 4 bulletins) and two exploited in wild in Microsoft release
• #8: Shavlik Priority: Shavlik rates this bulletin as a Priority 1. This means you should update as soon as possible on all systems. To fully resolve Flash vulnerabilities you need to update all versions of Flash and Plug-ins on machines. This includes Flash for the OS, Flash plug-in for IE, Chrome, and for FireFox. Flash has seen multiple exploits in the wild this year. Consider this urgent on all systems. Remove or update without question.
• #9: Shavlik Priority: Shavlik rates this bulletin as a Priority 1. This means you should update as soon as possible on all systems. This update is required to resolve the latest Flash 18 plug-in update which has 35 vulnerabilities. The update likely includes additional security fixes, but specific count and CVE numbers were not yet available.
• #10: Shavlik Priority: Shavlik rates this bulletin as a Priority 1. This means you should update as soon as possible on all systems.
• #11: Shavlik Priority: Shavlik rates this bulletin as a Priority 1. This means you should update as soon as possible on all systems. The security update for Windows 10 that is dated August 11, 2015, includes improvements to improve the functionality of Windows 10 and resolves the following vulnerabilities in Windows: 3086251 MS15-092: Vulnerabilities in the .NET Framework could allow elevation of privilege: August 11, 2015 3084525 MS15-091: Cumulative security update for Microsoft Edge: August 11, 2015 3082458 MS15-088: Unsafe command-line parameter passing could allow information disclosure: August 11, 2015 3082487 MS15-085: Vulnerability in Mount Manager could allow elevation of privilege: August 11, 2015 3078662 MS15-080: Vulnerabilities in Microsoft graphics component could allow remote code execution: August 11, 2015 3082442 MS15-079: Cumulative security update for Internet Explorer: August 11, 2015 Windows 10 updates are cumulative. Therefore, this package contains all previously released fixes.
• #12: Shavlik Priority: Shavlik rates this bulletin as a Priority 1. This means you should update as soon as possible on all systems. Public Disclosure: CVE-2015-2423 To exploit this vulnerability, an attacker would first need to leverage another vulnerability and execute code in Internet Explorer with EPM, and then execute Excel, Notepad, PowerPoint, Visio, or Word using an unsafe command line parameter. The update addresses the vulnerability by improving how Notepad and Microsoft Office programs are executed from Internet Explorer.
• #13: Shavlik Priority: Shavlik rates this bulletin as a Priority 1. This means you should update as soon as possible on all systems. Public Disclosure: CVE-2015-2433 A security feature bypass vulnerability exists when the Windows kernel fails to properly initialize a memory address, allowing an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (KASLR) bypass. This issue affects all supported Windows operating systems and is considered to be an Important-class Security Feature Bypass (SFB).  An attacker who successfully exploited this vulnerability could retrieve the base address of the kernel driver from a compromised process. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The security update addresses the vulnerability by correcting how the Windows kernel handles memory addresses. 
• #14: Shavlik Priority: Shavlik rates this bulletin as a Priority 1. This means you should update as soon as possible on all systems. Public Exploit: CVE-2015-1642 In an email attack scenario an attacker could exploit the vulnerabilities by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerabilities. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince them to open the specially crafted file. Public Disclosure: CVE-2015-2423 To exploit this vulnerability, an attacker would first need to leverage another vulnerability and execute code in Internet Explorer with EPM, and then execute Excel, Notepad, PowerPoint, Visio, or Word using an unsafe command line parameter. The update addresses the vulnerability by improving how Notepad and Microsoft Office programs are executed from Internet Explorer. Known Issues: https://support.microsoft.com/en-us/kb/3080790 Starting on August 12, 2015, users of the 2007 Microsoft Office system who do not have the update installed will no longer be able to access online templates. Instead, when they try to access online templates, a single template thumbnail appears together with text that tells them to update Office to regain access to templates. For more information, see http://aka.ms/2007. Be aware that 2007 Microsoft Office system users who do not have this update installed are still vulnerable. This is true even when it seems that they do not have access to online templates. Many Nonsecurity-related fixes included in this update as well. See the complete list on the KB link above.
• #15: Shavlik Priority: Shavlik rates this bulletin as a Priority 2. This means the update should be implemented in a reasonable timeframe after adequate testing. Known Issues: https://support.microsoft.com/en-us/kb/3080348 If you install a language pack after installing this update you will need to reinstall this update. Known issues in security update 3075222: After you install or uninstall this security update, you may have to restart the computer two times. (Win 7 and Server 2008 R2 systems)
• #16: Shavlik Priority: Shavlik rates this bulletin as a Priority 2. This means the update should be implemented in a reasonable timeframe after adequate testing..
• #17: Shavlik Priority: Shavlik rates this bulletin as a Priority 2. This means the update should be implemented in a reasonable timeframe after adequate testing. CVE-2015-2434 and CVE-2015-2471 In a man-in-the-middle (MiTM) attack scenario, an attacker could force an encrypted SSL 2.0 session and then decrypt portions of encrypted network information traffic. This update resolves the issue by configuring MSXML to use more secure network protocols by default instead of SSL 2.0. CVE-2015-2440 To exploit the vulnerability, an attacker could host a specially-crafted website that is designed to invoke MSXML through Internet Explorer. However, an attacker would have no way to force a user to visit such a website. Instead, an attacker would typically have to convince a user to either click a link in an email message or a link in an Instant Messenger request that would then take the user to the website. The update addresses the vulnerability by modifying how Microsoft XML Core Services returns data requests.
• #18: Shavlik Priority: Shavlik rates this bulletin as a Priority 2. This means you should apply this update to systems within 30 days. Exploit Detected CVE-2015-1769 To exploit the vulnerability, an attacker would have insert a malicious USB device into a target system. The security update addresses this vulnerability by removing the vulnerable code from the component. Microsoft received information about this vulnerability through coordinated vulnerability disclosure. When this security bulletin was issued, Microsoft has reason to believe that this vulnerability has been used in targeted attacks against customers.
• #19: Shavlik Priority: Shavlik rates this bulletin as a Priority 2. This means the update should be implemented in a reasonable timeframe after adequate testing. An attacker could exploit this vulnerability by convincing a user to visit an affected website by way of a specially crafted URL. This can be done through any medium that can contain URL web links that are controlled by the attacker, such as a link in an email, a link on a website, or a redirect on a website. Additionally, compromised websites and websites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit such websites. Instead, an attacker would have to convince users to visit a website, typically by getting them to click a link in an email or Instant Messenger message that directs them to the affected website by way of a specially crafted URL. Users who are authorized to access System Center Operations Manager web consoles are primarily at risk from this vulnerability. The update addresses the vulnerability by modifying the way that System Center Operations Manager accepts input.
• #20: Shavlik Priority: Shavlik rates this bulletin as a Priority 2. This means the update should be implemented in a reasonable timeframe after adequate testing. To exploit the vulnerability, an attacker could engineer a cross-site scripting (XSS) scenario by inserting a malicious script into a webpage search parameter. When a user visits the specially crafted webpage the malicious script is executed. This update addresses the vulnerability by correcting how the UDDI Services encode and validate the parameter.
• #21: Shavlik Priority: Shavlik rates this bulletin as a Priority 2. This means the update should be implemented in a reasonable timeframe after adequate testing. Public Disclosure: CVE-2015-2423 To exploit this vulnerability, an attacker would first need to leverage another vulnerability and execute code in Internet Explorer with EPM, and then execute Excel, Notepad, PowerPoint, Visio, or Word using an unsafe command line parameter. The update addresses the vulnerability by improving how Notepad and Microsoft Office programs are executed from Internet Explorer.
• #22: Shavlik Priority: Shavlik rates this bulletin as a Priority 2. This means the update should be implemented in a reasonable timeframe after adequate testing. To exploit the vulnerability, an attacker could force an encrypted SSL 2.0 session with a WebDAV server that has SSL 2.0 enabled and use a man-in-the-middle (MiTM) attack to decrypt portions of the encrypted traffic. The security update addresses the vulnerability by ensuring that the Microsoft WebDAV client defaults to more secure protocols than SSL 2.0.
• #23: Shavlik Priority: Shavlik rates this bulletin as a Priority 2. This means the update should be implemented in a reasonable timeframe after adequate testing. CVE-2015-2428 In order to exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability by itself does not allow arbitrary code execution; however, an attacker could use this vulnerability in conjunction with another vulnerability to effect arbitrary code execution. The update addresses the vulnerability by correcting how Windows Object Manager handles object symbolic links created by a sandbox process., CVE-2015-2429 To exploit the vulnerability, an attacker would have to convince the user to open a specially crafted file that would invoke a vulnerable sandboxed application, resulting in a compromise of the sandbox. The attacker could then run programs with the privileges of the logged on user. The update addresses the vulnerability by preventing improper interaction with the registry by sandboxed applications. CVE-2015-2430 To exploit the vulnerability, an attacker would have to convince the user to open a specially crafted file that would invoke a vulnerable sandboxed application, allowing an attacker to escape the sandbox. The update addresses the vulnerability by preventing improper interaction with the filesystem by sandboxed applications.
• #24: Shavlik Priority: Shavlik rates this bulletin as a Priority 2. This means the update should be implemented in a reasonable timeframe after adequate testing. To exploit these vulnerabilities, an attacker would need to host a specially crafted .NET application and convince users to run the application. However, in all cases, an attacker would have no way to force users to run the application; an attacker would have to convince users to do so. The security update addresses the vulnerabilities by correcting RyuJIT compiler optimization for .NET Framework.
• #25: Shavlik Priority: Shavlik rates this bulletin as a Priority 3. Consider this update for testing and rollout when convenient. Note: Some 3rd party updates may be non-security, but are still classified in Protect as Security. This is due to the fact that the step from current to this version August include security fixes based on the version currently on a machine. It would only be considered non-security if you were up to the latest version before the non-security release was made available.
• #26: MS15-078 out of band release Added support for products: Adobe Acrobat DC, .Net Framework 4.6, WinSCP 4\5, Windows 10, VMware Horizon Client 2\3