Patch Tuesday Analysis - October 2015

Editor's Notes

• #6: 4 public disclosures (across 3 bulletins)
• #9: Shavlik Priority: Shavlik rates this bulletin as a Priority 1. This means you should update as soon as possible on all systems. Public Disclosures: CVE-2015-6056 CVE-2015-2552 CVE-2015-2553
• #10: Shavlik Priority: Shavlik rates this bulletin as a Priority 1. This means you should update as soon as possible on all systems. Public Disclosure: CVE-2015-6056 Remote code execution vulnerabilities exist in the way that the VBScript and JScript engines, when handling objects in memory in Internet Explorer, render. In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerabilities through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites, and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerabilities. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerabilities could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
• #11: Shavlik Priority: Shavlik rates this bulletin as a Priority 1. This means you should update as soon as possible on all systems. Remote code execution vulnerabilities exist in the way that the VBScript and JScript engines, when handling objects in memory in Internet Explorer, render. In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerabilities through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites, and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerabilities. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerabilities could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
• #12: Shavlik Priority: Shavlik rates this bulletin as a Priority 1. This means you should update as soon as possible on all systems. A remote code execution vulnerability exists when Windows Shell improperly handles objects in memory. An attacker who successfully exploited this vulnerability could cause arbitrary code to execute in the context of the current user. If a user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. For an attack to be successful, this vulnerability requires that a user open a specially crafted toolbar object in Windows. In an email attack scenario, an attacker could exploit the vulnerability by sending a specially crafted tool bar object to the user and by convincing the user to open it. The update addresses the vulnerability by modifying how Windows Shell handles objects in memory. In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. Such websites could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email or instant message that takes them to the attacker's website, or by opening an attachment sent through email. The update addresses the vulnerability by modifying how the Microsoft Tablet Input Band handles objects in memory.
• #13: Shavlik Priority: Shavlik rates this bulletin as a Priority 1. This means you should update as soon as possible on all systems. Public Disclosure: CVE-2015-6039 A security feature bypass vulnerability exists in Microsoft SharePoint. The vulnerability is caused when Office Marketplace is allowed to inject JavaScript code that persists onto a SharePoint page, because SharePoint does not enforce the appropriate permission level for an application or user. An attacker who successfully exploited this vulnerability could perform persistent cross-site scripting attacks and run script (in the security context of the logged-on user) with malicious content that appears authentic. This could allow the attacker to steal sensitive information, including authentication cookies and recently submitted data. To exploit this vulnerability, an attacker must have the ability to update the Marketplace instance. The attacker could add malicious code to the Marketplace app that could then be pushed to the consuming SharePoint instances. The malicious script would enable the attacker to update code without having to go through the SharePoint farm/instance-level permissions.
• #14: Shavlik Priority: Shavlik rates this bulletin as a Priority 1. This means you should update as soon as possible on all systems. Public Disclosure: CVE-2015-2552 CVE-2015-2553 A security feature bypass vulnerability exists when Windows fails to properly enforce the Windows Trusted Boot policy. An attacker who successfully exploited this vulnerability could disable code integrity checks, allowing test-signed executables and drivers to be loaded on a target device. Furthermore, an attacker could bypass Trusted Boot integrity validation for BitLocker and Device Encryption security features. An attacker who has gained administrative privileges or who has physical access to a target device could exploit the vulnerability by applying a maliciously crafted Boot Configuration Data (BCD) setting. The security update addresses the vulnerability by improving how Windows parses BCD. An elevation of privilege vulnerability exists when Windows improperly validates junctions in certain scenarios in which mount points are being created. An attacker who successfully exploited this vulnerability could potentially run arbitrary code in the security context of the user running a compromised application. To exploit this vulnerability, an attacker would most likely have to leverage another vulnerability that allows them to run arbitrary code in a sandboxed application. The update addresses the vulnerability by correcting how Windows handles certain scenarios involving junction and mount-point creation.
• #15: Shavlik Priority: Shavlik rates this bulletin as a Priority 1. This means you should update as soon as possible on all systems. This is bumped up to Priority 1 because of the huge number of vulnerabilities in the release.
• #16: Shavlik Priority: Shavlik rates this bulletin as a Priority 1. This means you should update as soon as possible on all systems. Flash player requires 4 updates to completely resolve all vulnerabilities. Flash Player and the Flash Plug-In for IE, Chrome and Firefox.
• #17: Shavlik Priority: Shavlik rates this bulletin as a Priority 1. This means you should update as soon as possible on all systems. Flash player requires 4 updates to completely resolve all vulnerabilities. Flash Player and the Flash Plug-In for IE, Chrome and Firefox.
• #18: Shavlik Priority: Shavlik rates this bulletin as a Priority 2. This means the update should be implemented in a reasonable timeframe after adequate testing. XSS Filter Bypass - CVE-2015-6058 A cross-site scripting (XSS) filter bypass exists in the way that Microsoft Edge disables an HTML attribute in otherwise appropriately filtered HTTP response data. The bypass could allow initially disabled scripts to run in the wrong security context, leading to information disclosure. An attacker could post on a website specially crafted content that is designed to exploit this bypass. The attacker would then have to convince the user to view the content on the affected website. If the user then browses to the website, the XSS filter disables HTML attributes in the specially crafted content, creating a condition that could allow malicious script to run in the wrong security context, leading to information disclosure. An attacker who successfully exploited this bypass could cause script to run on another user's system in the guise of a third-party website. Such script would run inside the browser when visiting the third-party website, and could take any action on the user's system that the third-party website was permitted to take. The bypass could only be exploited if the user clicked a hypertext link, either in an HTML email or if the user visited an attacker's website or a website containing content that is under the attacker’s control. Any systems where Microsoft Edge is used frequently, such as workstations and terminal servers, are at the most risk from this bypass.
• #19: Shavlik Priority: Shavlik rates this bulletin as a Priority 3. Consider this update for testing and rollout when convenient. Note: Some 3rd party updates may be non-security, but are still classified in Protect as Security. This is due to the fact that the step from current to this version October include security fixes based on the version currently on a machine. It would only be considered non-security if you were up to the latest version before the non-security release was made available.
• #20: Windows 10 Cumulatives: CSWU-008 – Includes feature changes. CSWU-009 – Includes feature changes. Server 2003 Custom Content Feed: **Added support for MS15-082, MS15-083, MS15-084, MS15-087, MS15-096, MS15-097 and MS15-101 **Added support for KB3072308 **Added support for MS15-094 Added support for products: PSPad, TeamViewer, Adobe After Effects CC, Dreamweaver CC, Photoshop CC, Exchange 2016