Microsoft Security Bulletin MS15-082 - Important

Published: August 11, 2015 | Updated: December 23, 2015

Version: 1.1

This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an attacker first places a specially crafted dynamic link library (DLL) file in the target user’s current working directory and then convinces the user to open a Remote Desktop Protocol (RDP) file or to launch a program that is designed to load a trusted DLL file but instead loads the attacker’s specially crafted DLL file. An attacker who successfully exploited the vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

This security update is rated Important for all supported releases of Microsoft Window except Windows 10, which is not affected. For more information, see the Affected Software section.

The security update addresses the vulnerability by correcting how the Remote Desktop Session Host (RDSH) validates certificates and by correcting how RDP loads certain binaries. For more information about the vulnerability, see the Vulnerability Information section.

For more information about this update, see Microsoft Knowledge Base Article 3080348.

The following software versions or editions are affected. Versions or editions that are not listed are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see Microsoft Support Lifecycle.

^[1]Customers running RDP 7.0 on supported editions of Windows Vista need only install update 3075221. See the Update FAQ for more information.

^[2]Customers running RDP 8.0 on supported editions of Windows 7 or Windows Server 2008 R2 need only install update 3075222. See the Update FAQ for more information.

^[3]Customers running RDP 8.1 on supported editions of Windows 7 or Windows Server 2008 R2 need only install update 3075226. See the Update FAQ for more information.

[4]This update is available via Windows Update only.

*The Updates Replaced column shows only the latest update in a chain of superseded updates. For a comprehensive list of updates replaced, go to the Microsoft Update Catalog, search for the update KB number, and then view update details (updates replaced information is on the Package Details tab).

I am running Windows Vista. Why am I not being offered both updates listed in the Affected Software table for Windows Vista? 
The update you need to install depends on whether you have RDP 7.0 installed on your computer:

• If you do not have RDP 7.0 installed, you need only install update 3075220 to be fully protected from the vulnerabilities described in this bulletin.
• If you have RDP 7.0 installed, you need only install update 3075221 to be fully protected from the vulnerabilities described in this bulletin.

For more information about RDP 7.0, see Microsoft Knowledge Base Article 969084.

I am running Windows 7 or Windows Server 2008 R2. Why am I not being offered all three of the updates listed in the Affected Software table for these editions of Windows?
The update you need to install depends on which version of RDP you have installed on your computer:

• If you do not have any version of RDP installed, you need only install update 3075220 to be fully protected from the vulnerabilities described in this bulletin.
• If you have RDP 8.0 installed, you need only install update 3075222 to be fully protected from the vulnerabilities described in this bulletin.
• If you have RDP 8.1 installed, you need only install update 3075226 to be fully protected from the vulnerabilities described in this bulletin.

For more information about RDP 8.0, see Microsoft Knowledge Base Article 2592687.

For more information about RDP 8.1, see Microsoft Knowledge Base Article 2830477.

The following severity ratings assume the potential maximum impact of the vulnerability. For information regarding the likelihood, within 30 days of this security bulletin's release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the August bulletin summary.

A spoofing vulnerability exists when the Remote Desktop Session Host (RDSH) improperly validates certificates during authentication. An attacker who successfully exploited this vulnerability could impersonate the client session.

To exploit the vulnerability, in a man-in-the-middle (MiTM) attack an attacker could generate an untrusted certificate that matches the issuer name and serial number of the trusted certificates. The update addresses the vulnerability by correcting how RDSH validates certificates.

Microsoft received information about this vulnerability through coordinated vulnerability disclosure. When this security bulletin was issued, Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers.

Microsoft has not identified any mitigating factors for this vulnerability.

Microsoft has not identified any workarounds for this vulnerability.

A remote code execution vulnerability exists when Microsoft Windows Remote Desktop Protocol client improperly handles the loading of certain specially crafted DLL files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

To exploit this vulnerability, an attacker would first have to place a specially crafted DLL file in the target user’s current working directory and then convince the user to open a specially crafted RDP file. In a web-based attack scenario an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted RDP file that is designed to exploit the vulnerability. An attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message.

The update addresses the vulnerability by correcting how the Windows RDP client loads certain binaries.

Microsoft received information about this vulnerability through coordinated vulnerability disclosure. When this security bulletin was issued, Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers.

The following mitigating factors may be helpful in your situation:

• By default, the RDP server service is not enabled on any Windows operating system. Systems that do not have the RDP server service enabled are not at risk.

The following workaround may be helpful in your situation:

• Remove the .rdp file association

  Warning Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.

  Method 1 (Manually edit the system registry):

  1. Click Start, click Run, type Regedit in the Open box, and then click OK.

  2. Expand HKEY_CLASSES_ROOT, click on RDP.File, and then click the File menu and select Export.

  3. In the Export Registry File dialog box, type RDPfile HKCR file association registry backup.reg and click Save. This will create a backup of this registry key in the My Documents folder by default.

  4. Press the Delete key on the keyboard to delete the registry key. When prompted to delete the registry value, click Yes.

  5. Navigate to the following registry location:

     HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
     

  6. Click on .rdp, then click the File menu and then click Export.

  7. Navigate to the following registry location:

     HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy
     

  8. In the Export Registry File dialog box, type HKCU file association registry backup.reg and then click Save.This will create a backup of this registry key in the My Documents folder by default.

  9. Press the Delete key on the keyboard to delete the registry key. When prompted to delete the registry value, click Yes.

  Method 2 (Use a managed deployment script):

  1. Create a backup copy of the registry keys by running the following commands:

     Regedit.exe /e rdpfile_HKCR_registry_backup.reg HKEY_CLASSES_ROOT\RDP.File 
     Regedit.exe /e rdp_HKCU_registry_backup.reg HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rdp
     

  2. Save the following to a file with a .REG extension (e.g. Delete_rdp_file_association.reg):

     Windows Registry Editor Version 5.00  
     [-HKEY_CLASSES_ROOT\RDP.File]  
     [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rdp]
     

  3. Click Start, click Run, type Regedit in the Open box, and then click OK.

  4. Run the registry script you created in step b on the target machine using the following command:

     Regedit.exe /s Delete_rdp_file_association.reg
     

Impact of workaround. Double clicking on a .jnt file will no longer launch journal.exe

How to undo the workaround

Restore the registry key by using Regedit to restore the settings you saved in the .REG files.

For Security Update Deployment information, see the Microsoft Knowledge Base article referenced in the Executive Summary.

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure. See Acknowledgments for more information.

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

• V1.0 (August 11, 2015): Bulletin published.
• V1.1 (December 23, 2015): Bulletin revised to correct the Updates Replaced for the Server Core installation option on Windows Server 2008 and Windows Server 2008 R2.This is an informational change only. Customers who have successfully installed the updates do not need to take any further action.

Page generated 2015-12-22 17:33Z-08:00.