Microsoft Security Updates July 2015

Microsoft releases a long list of updates to multiple technologies today with 14 Security Bulletins (MS15-058, MS15-065 – MS15-077) patching 58 vulnerabilities, and at least 47 of them reported through a a responsible disclosure channel. Meanwhile, several are being used and detected ITW as a part of limited targeted attacks, like the Microsoft Office RCE cve-2015-2424, ATMFD.DLL EoP cve-2015-2387, and the Internet Explorer JScript9 RCE cve-2015-2419. Some were the result of breach leaks as well. A number of these have a very attractive offensive utility to defend against, so expect to see these exploits being used and re-used. Most of the July updates fall under two main categories, and the updated technologies are listed below. All of the Windows versions from Windows 7 and up maintain a critical RCE vulnerability of one sort or another. Update ASAP.

Remote code execution vulnerabilities

• Windows Server Hyper-V
• Windows DLL Handling
• SQL Server
• Internet Explorer
• VBScript Engine
• Remote Desktop Protocol (RDP)
• Microsoft Office

Elevation of privilege vulnerabilities

• Windows Graphics Component
• Windows Kernel (win32k.sys)
• Windows Installer Service
• OLE
• Windows Remote Procedure Call Service
• Windows ATM Font Driver
• SQL Server

Vulnerabilities falling under other categories like XSS filter bypass, information disclosure, ASLR bypass, authentication spoofing

• Internet Explorer
• Microsoft Excel
• Netlogon
• Windows Kernel (win32k.sys)

The most interesting of these vulnerabilities includes the RDP RCE and the Hyper-V RCE. The RDP vulnerability affects even the stripped down Windows Server 2012 Server Core installation, and seems to have been reported by an anonymous source unusually wanting no credit for a remotely exploitable critical vulnerability for a service that is often externally exposed. While Microsoft is doubtful that remote code execution is reliable, they at least acknowledge the possibility. In the past, their denial had been corrected by researchers on the potential for heap feng shei leading to exploitation of certain services, including the 2010 bug in their IIS FTPsvc.

Another couple are the Hyper-V RCE, which are buffer overflow cve-2015-2361 in the Storvsp.sys driver and an unusual “data structure vulnerability” cve-2015-2362 present in Vmicrdv.dll, Vmicvss.dll, Vmicshutdown.dll, Vmictimesync.dll, Vmicheartbeat.dll, and Vmickvpexchange.dll, available across Windows Hyper-V on Windows Server 2008, Windows Server 2008 R2, Windows 8 and Windows Server 2012, and Windows 8.1 and Windows Server 2012 R2. These were both found by an internal Microsoft engineer. Much like the Cloudburst exploit from years ago on VMWare, these enable code with execution escape from a virtual guest operating system into the host system.

Full list of July cve being updated here:

cve-2015-1729
cve-2015-1733
cve-2015-1738
cve-2015-1761
cve-2015-1762
cve-2015-1763
cve-2015-1767
cve-2015-2361
cve-2015-2362
cve-2015-2363
cve-2015-2364
cve-2015-2365
cve-2015-2366
cve-2015-2367
cve-2015-2368
cve-2015-2369
cve-2015-2370
cve-2015-2371
cve-2015-2372
cve-2015-2373
cve-2015-2374
cve-2015-2375
cve-2015-2376
cve-2015-2377
cve-2015-2378
cve-2015-2379
cve-2015-2380
cve-2015-2381
cve-2015-2382
cve-2015-2383
cve-2015-2384
cve-2015-2385
cve-2015-2387
cve-2015-2388
cve-2015-2389
cve-2015-2390
cve-2015-2391
cve-2015-2397
cve-2015-2398
cve-2015-2401
cve-2015-2402
cve-2015-2403
cve-2015-2404
cve-2015-2406
cve-2015-2408
cve-2015-2410
cve-2015-2411
cve-2015-2412
cve-2015-2413
cve-2015-2414
cve-2015-2415
cve-2015-2416
cve-2015-2417
cve-2015-2419
cve-2015-2421
cve-2015-2422
cve-2015-2424
cve-2015-2425