Microsoft Security Bulletin MS15-069 - Important

Vulnerabilities in Windows Could Allow Remote Code Execution (3072631)

Published: July 14, 2015 | Updated: July 29, 2015

Version: 1.1

Executive Summary

This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow Remote Code Execution if an attacker first places a specially crafted dynamic link library (DLL) file in the target user’s current working directory and then convinces the user to open an RTF file or to launch a program that is designed to load a trusted DLL file but instead loads the attacker’s specially crafted DLL file. An attacker who successfully exploited the vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

This security update is rated Important for all supported editions of Windows Server 2003 (excluding Itanium), Windows Vista, Windows Server 2008 (excluding Itanium), Windows 7, Windows Server 2008 R2 (excluding Itanium), Windows 8.1, Windows 2012 R2, and Windows RT 8.1. For more information, see the Affected Software section.

The security update addresses the vulnerabilities by correcting how Windows loads certain DLL files and how Windows Media Device Manager loads certain binaries. For more information about the vulnerabilities, see the Vulnerability Information section.

For more information about this update, see Microsoft Knowledge Base Article 3072631.

Affected Software

The following software versions or editions are affected. Versions or editions that are not listed are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see Microsoft Support Lifecycle.

^[1]This update is available via Windows Update only.

^[2]Windows Server 2008 and Windows 2008 R2 systems are affected only if Desktop Experience is installed.

^[3]Systems are affected only if RDP 8.1 is installed.

Update FAQ

What is the Format Software Development Kit (FSDK)? 
The Microsoft Windows Media Format Software Development Kit (SDK) enables developers to create applications that manipulate digital media stored in files conforming to the Advanced Systems Format (ASF) file structure. For more information, see About the Windows Media Format SDK.

Severity Ratings and Vulnerability Identifiers

The following severity ratings assume the potential maximum impact of the vulnerability. For information regarding the likelihood, within 30 days of this security bulletin's release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the July bulletin summary.

^[1]Windows Server 2008 and Windows Server 2008 R2 systems are affected only if Desktop Experience is installed.

^[2]Systems are affected only if RDP 8.1 is installed.

Vulnerability Information

Windows DLL Remote Code Execution Vulnerability - CVE-2015-2368

A remote code execution vulnerability exists when Microsoft Windows improperly handles the loading of dynamic link library (DLL) files. An attacker who successfully exploited the vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

To exploit the vulnerability, an attacker would first have to place a specially crafted DLL file in the target user’s current working directory and then convince the user to launch a program that is designed to load a trusted DLL file but instead loads the attacker’s specially crafted DLL file. The update addresses the vulnerability by correcting how Windows handles the loading of certain DLL files.

Microsoft received information about this vulnerability through coordinated vulnerability disclosure. When this security bulletin was issued, Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers.

Mitigating Factors

Microsoft has not identified any mitigating factors for this vulnerability.

Workarounds

Microsoft has not identified any workarounds for this vulnerability.

DLL Planting Remote Code Execution Vulnerability - CVE-2015-2369

A remote code execution vulnerability exists when Microsoft Windows Media Device Manager improperly handles the loading of certain specially crafted DLL files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

To exploit this vulnerability, an attacker would first have to place a specially crafted DLL file in the target user’s current working directory and then convince the user to open a specially crafted .RTF file. The attacker would have no way to force users to open the file. The update addresses the vulnerability by correcting how the Windows Media Device Manager loads certain binaries.

Microsoft received information about this vulnerability through coordinated vulnerability disclosure. When this security bulletin was issued, Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers.

Mitigating Factors

Microsoft has not identified any mitigating factors for this vulnerability.

Workarounds

The following workarounds may be helpful in your situation:

Modify the Registry to prevent Office documents from loading the WMDMCESP.WMDMCESP ActiveX control

Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

1. Create a text file named WMDMCESP-disable.reg that contains the following text:

Windows Registry Editor Version 5.00  
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common\COM Compatibility\{067B4B81-B1EC-489f-B111-940EBDC44EBE}]  
"Compatibility Flags"=dword:00000400

2. Run regedit.exe.
3. In Registry Editor, click the File menu, and then click Import.
4. Navigate to and select the WMDMCESP-disable.reg file that you created in the first step. (Note: If your file is not listed where you expect it to be, ensure that it has not been automatically given a .txt file extension, or change the dialog’s file extension parameters to All Files).
5. Click Open and then click OK to close Registry Editor.

Impact of workaround. Documents that use the WMDMCESP.WMDMCESP ActiveX control may not work properly.

How to undo the workaround.

1. Create a text file named WMDMCESP-enable.reg that contains the following text:

Windows Registry Editor Version 5.00  
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common\COM Compatibility\{067B4B81-B1EC-489f-B111-940EBDC44EBE}]  
"Compatibility Flags"=dword:00000000

2. Run regedit.exe.
3. In Registry Editor, click the File menu, and then click Import.
4. Navigate to and select the WMDMCESP-enable.reg file that you created in the first step. (Note: If your file is not listed where you expect it to be, ensure that it has not been automatically given a .txt file extension, or change the dialog’s file extension parameters to All Files).
5. Click Open and then click OK to close Registry Editor.

Security Update Deployment

For Security Update Deployment information, see the Microsoft Knowledge Base article referenced in the Executive Summary.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure. See Acknowledgments for more information.

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

• V1.0 (July 14, 2015): Bulletin published.
• V1.1 (July 29, 2015): Bulletin revised to correct the Desktop Experience footnote in the Affected Software section. The footnote had incorrectly applied to update 3070738 on Windows Server 2008 R2 when it should have applied to update 3067903 on Windows Server 2008 and Windows Server 2008 R2. Also added a footnote for the 3070738 update to clarify that only systems with RDP 8.1 installed are affected. These are informational changes only. Customers who have already successfully applied the updates do not need to take any action. Customers who have not already installed the necessary updates should do so to be protected from the vulnerability it addresses.

Page generated 2015-07-29 18:08Z-07:00.