Kaspersky Threats

Detect date

?

03/08/2016

Severity

?

Critical

Description

Multiple serious vulnerabilities have been found in Microsoft Windows. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code or gain privileges.

Below is a complete list of vulnerabilities

An improper input validation can be exploited by logged in attacker via a specially designed application to execute arbitrary code;
An improper OpenType fonts handling at Windows Adobe Type Manager Library can be exploited remotely via a specially designed content to cause denial of service or execute arbitrary code;
An improper resources handling at media library can be exploited remotely via a specially designed media content to execute arbitrary code;
An improper .pdf parsing can be exploited remotely via a specially designed pdf file to execute arbitrary code;
An improper input validation at OLE can be exploited remotely via a specially designed file, application or content to execute arbitrary code;
An improper memory handlers sanitization can be exploited by logged in attacker to gain privileges;
An improper request handling at Secondary Logon Service can be exploited by logged in attacker via a specially designed application to gain privileges;
An improper memory objects validation at USB Mass Storage Class can be exploited by attacker with physical access via a specially designed USB device to gain privileges;
An improper memory objects handling at Windows kernel-mode can be exploited by logged in attacker via a specially designed application to cause denial of service.

Technical details

Vulnerability (2) can be mitigated by renaming ATMFD.DLL and optionally (Fir Windows 8 and later OS) disabling ATMFD via registry. For further instructions you can navigate to MS16-026 listed in original advisories section.

Affected products

Microsoft Windows Vista Service Pack 2
Microsoft Windows Server 2008 Service Pack 2
Microsoft Windows 7 Service Pack 1
Microsoft Windows Server 2008 R2 Service Pack 1
Microsoft Windows 8.1
Microsoft Windows 2012
Microsoft Windows 2012 R2
Microsoft Windows RT 8.1
Microsoft Windows 10
Microsoft Windows 10 Version 1511

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories

CVE-2016-0094
CVE-2016-0095
CVE-2016-0121
CVE-2016-0120
CVE-2016-0118
CVE-2016-0087
CVE-2016-0091
CVE-2016-0092
CVE-2016-0093
CVE-2016-0098
CVE-2016-0096
CVE-2016-0100
CVE-2016-0099
CVE-2016-0101
CVE-2016-0133
CVE-2016-0117

Impacts

?

ACE

[?]

DoS

[?]

PE

[?]

Detect date ?	03/08/2016
Severity ?	Critical
Description	Multiple serious vulnerabilities have been found in Microsoft Windows. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code or gain privileges. Below is a complete list of vulnerabilities An improper input validation can be exploited by logged in attacker via a specially designed application to execute arbitrary code; An improper OpenType fonts handling at Windows Adobe Type Manager Library can be exploited remotely via a specially designed content to cause denial of service or execute arbitrary code; An improper resources handling at media library can be exploited remotely via a specially designed media content to execute arbitrary code; An improper .pdf parsing can be exploited remotely via a specially designed pdf file to execute arbitrary code; An improper input validation at OLE can be exploited remotely via a specially designed file, application or content to execute arbitrary code; An improper memory handlers sanitization can be exploited by logged in attacker to gain privileges; An improper request handling at Secondary Logon Service can be exploited by logged in attacker via a specially designed application to gain privileges; An improper memory objects validation at USB Mass Storage Class can be exploited by attacker with physical access via a specially designed USB device to gain privileges; An improper memory objects handling at Windows kernel-mode can be exploited by logged in attacker via a specially designed application to cause denial of service. Technical details Vulnerability (2) can be mitigated by renaming ATMFD.DLL and optionally (Fir Windows 8 and later OS) disabling ATMFD via registry. For further instructions you can navigate to MS16-026 listed in original advisories section.
Affected products	Microsoft Windows Vista Service Pack 2 Microsoft Windows Server 2008 Service Pack 2 Microsoft Windows 7 Service Pack 1 Microsoft Windows Server 2008 R2 Service Pack 1 Microsoft Windows 8.1 Microsoft Windows 2012 Microsoft Windows 2012 R2 Microsoft Windows RT 8.1 Microsoft Windows 10 Microsoft Windows 10 Version 1511
Solution	Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories	CVE-2016-0094 CVE-2016-0095 CVE-2016-0121 CVE-2016-0120 CVE-2016-0118 CVE-2016-0087 CVE-2016-0091 CVE-2016-0092 CVE-2016-0093 CVE-2016-0098 CVE-2016-0096 CVE-2016-0100 CVE-2016-0099 CVE-2016-0101 CVE-2016-0133 CVE-2016-0117
Impacts ?	ACE [?] DoS [?] PE [?]
Related products	Microsoft Windows Vista Microsoft Windows Server 2012 Microsoft Windows 8 Microsoft Windows 7 Microsoft Windows Server 2008 Windows RT Microsoft Windows 10
CVE-IDS ?	CVE-2016-00947.2High CVE-2016-00957.2High CVE-2016-01219.3Critical CVE-2016-01207.1High CVE-2016-01189.3Critical CVE-2016-00877.2High CVE-2016-00916.8High CVE-2016-00929.3Critical CVE-2016-00937.2High CVE-2016-00989.3Critical CVE-2016-00967.2High CVE-2016-01007.2High CVE-2016-00997.2High CVE-2016-01019.3Critical CVE-2016-01337.2High CVE-2016-01179.3Critical
Microsoft official advisories	Microsoft Security Update Guide
KB list	3140768 3140745 3139398 3139940 3140709 3143136 3138962 3139914 3140735 3143145 3143146 3140410 3143141 3143142 3143081 3139852 3137513 3143148 3138910
Exploitation	The following public exploits exists for this vulnerability: https://www.exploit-db.com/exploits/39647 https://www.exploit-db.com/exploits/39560 https://www.exploit-db.com/exploits/39561 https://www.exploit-db.com/exploits/39648 https://www.exploit-db.com/exploits/40107 https://www.exploit-db.com/exploits/39574 https://www.exploit-db.com/exploits/39719 https://www.exploit-db.com/exploits/39809 Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.