KLA10825
Multiple vulnerabilities in Microsoft Windows

Multiple serious vulnerabilities have been found in Microsoft Windows. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, cause denial of service, gain privileges or obtain sensitive information.

Below is a complete list of vulnerabilities

1. An improper requests handling at DNS servers can be exploited remotely via a specially designed requests to execute arbitrary code;
2. Lack of restrictions during processing group policy updates can be exploited from intranet via man-in-the-middle attack to gain privileges;
3. An improper memory objects handling can be exploited by logged in attacker to gain privileges;
4. An improper uninitialized memory handling at Virtual Service Provider can be exploited by logged in attacker via a specially designed application to obtain sensitive information;
5. An improper memory objects handling can be exploited remotely via a specially designed application to bypass Address Space Layout Randomization restrictions;
6. An improper memory objects handling can be exploited locally via a specially designed application to gain privileges;
7. An improper memory objects handling at Adobe Type Manager Font Driver can be exploited by logged in attacker via a specially designed application to gain privileges;
8. An improper credentials forwarding at SMB can be exploited by logged in attacker via a specially designed application to gain privileges;
9. An improper memory objects handling can be exploited by domain-authenticated attacker via a specially designed NetLogon request to gain privileges;
10. Lack of proxy handling can be exploited remotely via a specially designed NetBIOS name requests manipulations to gain privileges;
11. An improper proxy handling at WPAD can be exploited remotely to control traffic without sufficient privileges;
12. An improper input sanitization at Windows Diagnostics Hub Standard Collector Service can be exploited by logged in attacker via a specially designed application to gain privileges;
13. An improper .pdf files handling vulnerabilities can be exploited remotely via a specially designed pdf document to execute arbitrary code or obtain sensitive information;
14. An improper machine accounts creation at Active Directory can be exploited by user with sufficient rights via machine accounts manipulation to cause denial of service;
15. An improper memory objects handling can be exploited to cause denial of service.

Technical details

Vulnerability (1) can be exploited only when DNS server is configured.

Vulnerability (2) can be exploited by attack against traffic between a domain controller and target machine. Domain-joined systems with server running Windows Server 2012 and above and clients running Windows 8 and above.

Vulnerability (4) related to Virtual PCI.

Vulnerability (5) related to GDI32.dll

Vulnerability (7) related to ATMFD.dll

Vulnerability (8) can be exploited via forwarding an authentication request for another service running on the same machine. To mitigate this vulnerability you can enable Extended Protection for Authentication for SMB server. For further instructions, please take a look at original MS16-075 advisory listed below.

Vulnerability (10) related to WPAD and caused by falling back to a vulnerable proxy discovery process in some situations. To mitigate this vulnerability you can disable WINSNetBT name resolution or stop WPAD using a host file entry. For further instructions about mitigation you can take a look at original MS16-077 advisory listed below.

Vulnerability (11) can be mitigated via stopping WPAD useing a host file entry. For further instructions about mitigation you can take a look at original MS16-077 advisory listed below.

Microsoft Windows Vista Service Pack 2
Microsoft Windows Server 2008 Service Pack 2
Microsoft Windows 7 Service Pack 1
Microsoft Windows Server 2008 R2 Service Pack 1
Microsoft Windows 8.1
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Microsoft Windows RT 8.1
Microsoft Windows 10
Microsoft Windows 10 Versioin 1511

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

CVE-2016-3215
CVE-2016-3213
CVE-2016-3203
CVE-2016-3201
CVE-2016-3220
CVE-2016-3219
CVE-2016-3218
CVE-2016-3216
CVE-2016-3299
CVE-2016-3236
CVE-2016-3232
CVE-2016-3231
CVE-2016-3228
CVE-2016-3227
CVE-2016-3225
CVE-2016-3223
CVE-2016-3221

3162343
3161561
3163017
3163018
3159398
3161949
3161664
3164033
3164035
3164294
3157569
3161951

The following public exploits exists for this vulnerability:

https://www.exploit-db.com/exploits/39991

https://www.exploit-db.com/exploits/39993

https://www.exploit-db.com/exploits/39990

https://www.exploit-db.com/exploits/45562

https://www.exploit-db.com/exploits/40219

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.