Multiple vulnerabilities in Microsoft Windows

Description

Multiple serious vulnerabilities have been found in Microsoft Windows. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, cause denial of service, gain privileges or obtain sensitive information. Below is a complete list of vulnerabilities

1. An improper requests handling at DNS servers can be exploited remotely via a specially designed requests to execute arbitrary code;
2. Lack of restrictions during processing group policy updates can be exploited from intranet via man-in-the-middle attack to gain privileges;
3. An improper memory objects handling can be exploited by logged in attacker to gain privileges;
4. An improper uninitialized memory handling at Virtual Service Provider can be exploited by logged in attacker via a specially designed application to obtain sensitive information;
5. An improper memory objects handling can be exploited remotely via a specially designed application to bypass Address Space Layout Randomization restrictions;
6. An improper memory objects handling can be exploited locally via a specially designed application to gain privileges;
7. An improper memory objects handling at Adobe Type Manager Font Driver can be exploited by logged in attacker via a specially designed application to gain privileges;
8. An improper credentials forwarding at SMB can be exploited by logged in attacker via a specially designed application to gain privileges;
9. An improper memory objects handling can be exploited by domain-authenticated attacker via a specially designed NetLogon request to gain privileges;
10. Lack of proxy handling can be exploited remotely via a specially designed NetBIOS name requests manipulations to gain privileges;
11. An improper proxy handling at WPAD can be exploited remotely to control traffic without sufficient privileges;
12. An improper input sanitization at Windows Diagnostics Hub Standard Collector Service can be exploited by logged in attacker via a specially designed application to gain privileges;
13. An improper .pdf files handling vulnerabilities can be exploited remotely via a specially designed pdf document to execute arbitrary code or obtain sensitive information;
14. An improper machine accounts creation at Active Directory can be exploited by user with sufficient rights via machine accounts manipulation to cause denial of service.

Original advisories

• CVE-2016-3201

• CVE-2016-3203
• CVE-2016-3213
• CVE-2016-3215
• CVE-2016-3216
• CVE-2016-3218
• CVE-2016-3219
• CVE-2016-3220
• CVE-2016-3221
• CVE-2016-3223
• CVE-2016-3225
• CVE-2016-3231
• CVE-2016-3236
• CVE-2016-3299

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

• Microsoft-Windows
• Microsoft-Windows-Vista
• Microsoft-Windows-8
• Windows-RT
• Microsoft-Windows-10

CVE list

• CVE-2016-3215
  high
• CVE-2016-3213
  critical
• CVE-2016-3203
  critical
• CVE-2016-3201
  high
• CVE-2016-3220
  critical
• CVE-2016-3219
  critical
• CVE-2016-3218
  critical
• CVE-2016-3216
  warning
• CVE-2016-3299
  high
• CVE-2016-3236
  critical
• CVE-2016-3231
  critical
• CVE-2016-3225
  critical
• CVE-2016-3223
  critical
• CVE-2016-3221
  critical

KB list

• 3161561
• 3163017
• 3163018
• 3159398
• 3161949
• 3161664
• 3164033
• 3164035
• 3157569

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com