Microsoft Security Bulletin MS15-069 - Important

Vulnerabilities in Windows Could Allow Remote Code Execution (3072631)

Published: July 14, 2015 | Updated: July 29, 2015

Version: 1.1

This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow Remote Code Execution if an attacker first places a specially crafted dynamic link library (DLL) file in the target user’s current working directory and then convinces the user to open an RTF file or to launch a program that is designed to load a trusted DLL file but instead loads the attacker’s specially crafted DLL file. An attacker who successfully exploited the vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

This security update is rated Important for all supported editions of Windows Server 2003 (excluding Itanium), Windows Vista, Windows Server 2008 (excluding Itanium), Windows 7, Windows Server 2008 R2 (excluding Itanium), Windows 8.1, Windows 2012 R2, and Windows RT 8.1. For more information, see the Affected Software section.

The security update addresses the vulnerabilities by correcting how Windows loads certain DLL files and how Windows Media Device Manager loads certain binaries. For more information about the vulnerabilities, see the Vulnerability Information section.

For more information about this update, see Microsoft Knowledge Base Article 3072631.

The following software versions or editions are affected. Versions or editions that are not listed are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see Microsoft Support Lifecycle.

Operating System

Component

Maximum Security Impact

Aggregate Severity Rating

Updates Replaced

Windows Server 2003

Windows Server 2003 Service Pack 2
(3067903)

Not applicable

Remote Code Execution

Important

None

Windows Server 2003 Service Pack 2

Windows Media Format SDK 11[1]
(3067903)

Remote Code Execution

Important

None

Windows Server 2003 x64 Edition Service Pack 2
(3067903)

Not applicable

Remote Code Execution

Important

None

Windows Server 2003 x64 Edition Service Pack 2

Windows Media Format SDK 11[1]
(3067903)

Remote Code Execution

Important

None

Windows Vista

Windows Vista Service Pack 2
(3067903)

Not applicable

Remote Code Execution

Important

None

Windows Vista x64 Edition Service Pack 2
(3067903)

Not applicable

Remote Code Execution

Important

None

Windows Server 2008

Windows Server 2008 for 32-bit Systems Service Pack 2 [2]
(3067903)

Not applicable

Remote Code Execution

Important

None

Windows Server 2008 for x64-based Systems Service Pack 2 [2]
(3067903)

Not applicable

Remote Code Execution

Important

None

Windows 7

Windows 7 for 32-bit Systems Service Pack 1
(3067903)

Not applicable

Remote Code Execution

Important

None

Windows 7 for 32-bit Systems Service Pack 1 [3]
(3070738)

Not applicable

Remote Code Execution

Important

None

Windows 7 for x64-based Systems Service Pack 1
(3067903)

Not applicable

Remote Code Execution

Important

None

Windows 7 for x64-based Systems Service Pack 1 [3]
(3070738)

Not applicable

Remote Code Execution

Important

None

Windows Server 2008 R2

Windows Server 2008 R2 for x64-based Systems Service Pack 1 [2]
(3067903)

Not applicable

Remote Code Execution

Important

None

Windows Server 2008 R2 for x64-based Systems Service Pack 1 [3]
(3070738)

Not applicable

Remote Code Execution

Important

None

Windows 8.1

Windows 8.1 for 32-bit Systems
(3061512)

Not applicable

Remote Code Execution

Important

None

Windows 8.1 for x64-based Systems
(3061512)

Not applicable

Remote Code Execution

Important

None

Windows Server 2012 R2

Windows Server 2012 R2
(3061512)

Not applicable

Remote Code Execution

Important

None

Windows RT 8.1

Windows RT 8.1[1]
(3061512)

Not applicable

Remote Code Execution

Important

None

[1]This update is available via Windows Update only.

[2]Windows Server 2008 and Windows 2008 R2 systems are affected only if Desktop Experience is installed.

[3]Systems are affected only if RDP 8.1 is installed.


What is the Format Software Development Kit (FSDK)? 
The Microsoft Windows Media Format Software Development Kit (SDK) enables developers to create applications that manipulate digital media stored in files conforming to the Advanced Systems Format (ASF) file structure. For more information, see About the Windows Media Format SDK.

The following severity ratings assume the potential maximum impact of the vulnerability. For information regarding the likelihood, within 30 days of this security bulletin's release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the July bulletin summary.

Vulnerability Severity Rating and Maximum Security Impact by Affected Software

Affected Software

Windows DLL Remote Code Execution Vulnerability - CVE-2015-2368

DLL Planting Remote Code Execution Vulnerability - CVE-2015-2369

Aggregate Severity Rating

Windows Server 2003

Windows Server 2003 Service Pack 2
(3067903)

Not applicable

Important 
Remote Code Execution

Important

Windows Media Format SDK 11 on Windows Server 2003 Service Pack 2
(3067903)

Not applicable

Important 
Remote Code Execution

Important

Windows Server 2003 x64 Edition Service Pack 2
(3067903)

Not applicable

Important 
Remote Code Execution

Important

Windows Media Format SDK 11 on Windows Server 2003 x64 Edition Service Pack 2
(3067903)

Not applicable

Important 
Remote Code Execution

Important

Windows Vista

Windows Vista Service Pack 2
(3067903)

Not applicable

Important 
Remote Code Execution

Important

Windows Vista x64 Edition Service Pack 2
(3067903)

Not applicable

Important 
Remote Code Execution

Important

Windows Server 2008

Windows Server 2008 for 32-bit Systems Service Pack 2[1]
(3067903)

Not applicable

Important 
Remote Code Execution

Important

Windows Server 2008 for x64-based Systems Service Pack 2[1]
(3067903)

Not applicable

Important 
Remote Code Execution

Important

Windows 7

Windows 7 for 32-bit Systems Service Pack 1
(3067903)

Not applicable

Important 
Remote Code Execution

Important

Windows 7 for 32-bit Systems Service Pack 1[2]
(3070738)

Important 
Remote Code Execution

Not applicable

Important

Windows 7 for x64-based Systems Service Pack 1
(3067903)

Not applicable

Important 
Remote Code Execution

Important

Windows 7 for x64-based Systems Service Pack 1[2]
(3070738)

Important 
Remote Code Execution

Not applicable

Important

Windows Server 2008 R2

Windows Server 2008 R2 for x64-based Systems Service Pack 1[1]
(3067903)

Not applicable

Important 
Remote Code Execution

Important

Windows Server 2008 R2 for x64-based Systems Service Pack 1[2]
(3070738)

Important 
Remote Code Execution

Not applicable

Important

Windows 8.1

Windows 8.1 for 32-bit Systems
(3061512)

Important 
Remote Code Execution

Not applicable

Important

Windows 8.1 for x64-based Systems
(3061512)

Important 
Remote Code Execution

Not applicable

Important

Windows Server 2012 R2

Windows Server 2012 R2
(3061512)

Important 
Remote Code Execution

Not applicable

Important

Windows RT 8.1

Windows RT 8.1
(3061512)

Important 
Remote Code Execution

Not applicable

Important

[1]Windows Server 2008 and Windows Server 2008 R2 systems are affected only if Desktop Experience is installed.

[2]Systems are affected only if RDP 8.1 is installed.

Windows DLL Remote Code Execution Vulnerability - CVE-2015-2368

A remote code execution vulnerability exists when Microsoft Windows improperly handles the loading of dynamic link library (DLL) files. An attacker who successfully exploited the vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

To exploit the vulnerability, an attacker would first have to place a specially crafted DLL file in the target user’s current working directory and then convince the user to launch a program that is designed to load a trusted DLL file but instead loads the attacker’s specially crafted DLL file. The update addresses the vulnerability by correcting how Windows handles the loading of certain DLL files.

Microsoft received information about this vulnerability through coordinated vulnerability disclosure. When this security bulletin was issued, Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers.

Mitigating Factors

Microsoft has not identified any mitigating factors for this vulnerability.

Workarounds

Microsoft has not identified any workarounds for this vulnerability.

DLL Planting Remote Code Execution Vulnerability - CVE-2015-2369

A remote code execution vulnerability exists when Microsoft Windows Media Device Manager improperly handles the loading of certain specially crafted DLL files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

To exploit this vulnerability, an attacker would first have to place a specially crafted DLL file in the target user’s current working directory and then convince the user to open a specially crafted .RTF file. The attacker would have no way to force users to open the file. The update addresses the vulnerability by correcting how the Windows Media Device Manager loads certain binaries.

Microsoft received information about this vulnerability through coordinated vulnerability disclosure. When this security bulletin was issued, Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers.

Mitigating Factors

Microsoft has not identified any mitigating factors for this vulnerability.

Workarounds

The following workarounds may be helpful in your situation:

Modify the Registry to prevent Office documents from loading the WMDMCESP.WMDMCESP ActiveX control

Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

  1. Create a text file named WMDMCESP-disable.reg that contains the following text:
    Windows Registry Editor Version 5.00
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common\COM Compatibility\{067B4B81-B1EC-489f-B111-940EBDC44EBE}]
    "Compatibility Flags"=dword:00000400
    
  2. Run regedit.exe.
  3. In Registry Editor, click the File menu, and then click Import.
  4. Navigate to and select the WMDMCESP-disable.reg file that you created in the first step.
    (Note: If your file is not listed where you expect it to be, ensure that it has not been automatically given a .txt file extension, or change the dialog’s file extension parameters to All Files).
  5. Click Open and then click OK to close Registry Editor.

Impact of workaround. Documents that use the WMDMCESP.WMDMCESP ActiveX control may not work properly.

How to undo the workaround. 

  1. Create a text file named WMDMCESP-enable.reg that contains the following text:
    Windows Registry Editor Version 5.00
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common\COM Compatibility\{067B4B81-B1EC-489f-B111-940EBDC44EBE}]
    "Compatibility Flags"=dword:00000000
    
  2. Run regedit.exe.
  3. In Registry Editor, click the File menu, and then click Import.
  4. Navigate to and select the WMDMCESP-enable.reg file that you created in the first step.
    (Note: If your file is not listed where you expect it to be, ensure that it has not been automatically given a .txt file extension, or change the dialog’s file extension parameters to All Files).
  5. Click Open and then click OK to close Registry Editor.

For Security Update Deployment information, see the Microsoft Knowledge Base article referenced here in the Executive Summary.

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure. See Acknowledgments for more information.

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

  • V1.0 (July 14, 2015): Bulletin published.
  • V1.1 (July 29, 2015): Bulletin revised to correct the Desktop Experience footnote in the Affected Software section. The footnote had incorrectly applied to update 3070738 on Windows Server 2008 R2 when it should have applied to update 3067903 on Windows Server 2008 and Windows Server 2008 R2. Also added a footnote for the 3070738 update to clarify that only systems with RDP 8.1 installed are affected. These are informational changes only. Customers who have already successfully applied the updates do not need to take any action. Customers who have not already installed the necessary updates should do so to be protected from the vulnerability it addresses.

Page generated 2015-07-29 18:08Z-07:00.
Show: