DIESER SERVICE KANN ÜBERSETZUNGEN VON GOOGLE ENTHALTEN. GOOGLE ÜBERNIMMT KEINERLEI VERANTWORTUNG FÜR DIE ÜBERSETZUNGEN. DARUNTER FÄLLT JEGLICHE VERANTWORTUNG IN BEZUG AUF RICHTIGKEIT UND ZUVERLÄSSIGKEIT SOWIE JEGLICHE STILLSCHWEIGENDEN GEWÄHRLEISTUNGEN DER MARKTGÄNGIGKEIT, NICHT-VERLETZUNG VON RECHTEN DRITTER ODER DER EIGNUNG FÜR EINEN BESTIMMTEN ZWECK.

Die Website von Kaspersky Lab wurde für Ihre Bequemlichkeit mithilfe einer Übersetzungssoftware von Google Translate übersetzt. Es wurden angemessene Bemühungen für die Bereitstellung einer akkuraten Übersetzung unternommen. Bitte beachten Sie, dass automatisierte Übersetzungen nicht perfekt sind und menschliche Übersetzer in keinem Fall ersetzen sollen. Übersetzungen werden den Nutzern der Kaspersky-Lab-Website als Service und "wie sie sind" zur Verfügung gestellt. Die Richtigkeit, Zuverlässigkeit oder Korrektheit jeglicher Übersetzungen aus dem Englischen in eine andere Sprache wird weder ausdrücklich noch stillschweigend garantiert. Einige Inhalte (z. B. Bilder, Videos, Flash, usw.) können aufgrund der Einschränkungen der Übersetzungssoftware möglicherweise nicht inhaltsgetreu übersetzt werden.

KLA10694
Multiple vulnerabilities in Microsoft Windows
Aktualisiert: 03/29/2019
Erkennungsdatum
?
11/10/2015
Schweregrad
?
Kritisch
Beschreibung

Multiple serious vulnerabilities have been found in Microsoft Windows. Malicious users can exploit these vulnerabilities to spoof user interface, cause denial of service, gain privileges, bypass security restrictions, execute arbitrary code or obtain sensitive information.

Below is a complete list of vulnerabilities

  1. Improper memory objects access at Edge can be exploited remotely via a specially designed web content to bypass security restrictions or execute arbitrary code;
  2. Improper ASLR (Address Space Layout Randomization) implementation at Edge can be exploited remotely via a specially designed web content to bypass security restrictions;
  3. Improper memory objects handling at kernel can be exploited by logged in user via a specially designed application to gain privileges;
  4. Improper memory addresses initialization at kermel can be exploited by logged in user via a specially designed application to bypass security restrictions and obtain sensitive information;
  5. Improper handling of embedded fonts at Adobe Type Manager Library can be exploited remotely via a specially designed web content or document to execute arbitrary code;
  6. Improper permissions validation at kernel can be exploited by logged in user via a specially designed application to bypass security restrictions;
  7. Improper buffer handling at Network Driver Interface Standard can be exploited by logged in user via a specially designed application to gain privileges;
  8. Lack of memory address verification at Winsock can be exploited by logged in user via a specially designed application to gain privileges;
  9. Improper encryption negotiation handling at Internet Protocol Security can be exploited by remote user with valid credentials via a specially designed application to cause denial of service;
  10. Weakness at supported versions of Transport Layer Security protocol can be exploited remotely via man-in-the-middle attack to spoof user impersonation;
  11. Improper password change handling at Kerberos can be exploited via a login manipulations to bypass security restrictions;
  12. An unknown vulnerability at Windows Journal can be exploited remotely via a specially designed Journal file to execute arbitrary code.

Technical details

Vulnerability (4) can lead to Kernel ASLR bypass.

Vulnerability (7) caused by not checking buffer size prior to copy memory into it.

Vulnerability (8) caused by not checking memory address validity before call.

To exploit (10) remote attacker must cause man-in-the-middle attack between client and legitimate server. By exploiting this vulnerability attacker can impersonate victim on any other server that uses credentials same with attacked.

Vulnerability (11) caused by failing to check the password change of a user signing into a workstation. By exploiting this vulnerability attacker can bypass Kerberos authentication and decrypt drives protected by BitLocker.

Vulnerability (12) has multiple described mitigations designed to prevent opening malicious log file. Short list placed further, for full description look at MS15-115 advisory. Mitigations: do not open suspicious .jnt files; remove .jnt file association; remove Windows Journal; deny access to Journal.exe.

Beeinträchtigte Produkte

Microsoft Windows 10
Microsoft Windows 10 Version 1511
Microsoft Windows Vista Service Pack 2
Microsoft Windows Server 2008 Service Pack 2
Microsoft Windows 7 Service Pack 1
Microsoft Windows Server 2008 R2 Service Pack 1
Microsoft Windows 8
Microsoft Windows 8.1
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2

Lösung

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Ursprüngliche Informationshinweise

CVE-2015-6064
CVE-2015-6113
CVE-2015-6078
CVE-2015-2478
CVE-2015-6088
CVE-2015-6098
CVE-2015-6097
CVE-2015-6073
CVE-2015-6100
CVE-2015-6112
CVE-2015-6111
CVE-2015-6109
CVE-2015-6104
CVE-2015-6103
CVE-2015-6102
CVE-2015-6101
CVE-2015-6095

Folgen
?
ACE 
[?]

OSI 
[?]

DoS 
[?]

SB 
[?]

PE 
[?]

SUI 
[?]
CVE-IDS
?
CVE-2015-60649.3Critical
CVE-2015-61133.6Critical
CVE-2015-60789.3Critical
CVE-2015-24787.2Critical
CVE-2015-60884.3Critical
CVE-2015-60987.2Critical
CVE-2015-60979.3Critical
CVE-2015-60739.3Critical
CVE-2015-61007.2Critical
CVE-2015-61125.8Critical
CVE-2015-61116.8Critical
CVE-2015-61092.1Critical
CVE-2015-61049.3Critical
CVE-2015-61039.3Critical
CVE-2015-61022.1Critical
CVE-2015-61017.2Critical
CVE-2015-60954.9Critical
Offizielle Informationshinweise von Microsoft
Microsoft Sicherheitsupdate-Guide
KB-Liste

3081320
3100213
3105864
3097877
3105211
3102939
3105256
3092601
3101246
3105213
3104519
3101722
3104521
3101746


Link zum Original