VERT Alert: April 2015 Patch Tuesday Analysis

Image

Today’s VERT Alert addresses 11 new Microsoft Security Bulletins. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expects to ship ASPL-610 on Wednesday, April 15th.

MS15-032

This month starts like most others, with an update for Internet Explorer. In total, 10 CVEs are resolved, 9 that lead to memory corruption and a lone ASLR bypass. The good news is that none of the vulnerabilities this month has been publicly disclosed. That said, updating IE should always be a high priority.

MS15-033

Up next this month, we have the Microsoft Office “mega-bulletin”, which resolves multiple vulnerabilities affecting Microsoft Office, SharePoint Server, Office Web Apps Server, Office Word Viewer, and the Compatibility Pack. There’s no shortage of affected products in this bulletin.

MS15-034

A critical vulnerability this month is MS15-034, a remote code execution in HTTP.sys, meaning that IIS is affected. There are no reports of public exploitation at this time but given the nature of this vulnerability, it will likely be a popular target for attackers, applying this patch as soon as possible is critical. The vulnerability involves the handling of specially crafted HTTP requests.

MS15-035

Also on the list this month is another graphic processing vulnerability. We’ve seen a couple of vulnerabilities of this nature this year and all of them are rather similar. They affect a specific graphic format; in this case Enhanced Metafile (EMF) images, and they can be used in a drive-by attack scenario.

MS15-036

The next bulletin this month resolves two cross-site scripting vulnerabilities in Microsoft SharePoint 2013 and Microsoft Project Server. While Microsoft considers XSS to be an elevation of privilege, keep in mind that it will allow the attacker to execute script in your browser, which could have worse outcomes than privilege escalation.

MS15-037

MS15-037 is an interesting update because no files are included in the patch. Instead, the update looks for invalid scheduled tasks related to Windows Defender and removes them. The vulnerability described by CVE-2015-0098 has to do with using invalid tasks to execute your own applications, these applications will execute in the context of System.

MS15-038

The next update this month resolves two vulnerabilities in Windows that could lead to privilege escalation.

MS15-039

MSXML 3.0 ships with every supported version of Microsoft Windows. The vulnerability allows the attacker to download the Same Origin Policy by making use of the document type declaration (DTD) used in XML files.

MS15-040

A vulnerability that only affects Windows Server 2012 R2 is resolved in MS15-040, specifically on systems using Active Directory Federation Services. If a user logs off a session, ADFS may not properly terminate the session, allowing a malicious individual to reopen the application and resume the previous users session with their permissions and access.

MS15-041

The second last bulletin this month closes an information disclosure issue related to ASPL.NET custom error messages. When custom errors are disabled, the generation of an error could portions of the web configuration file. Microsoft has noted that this is not the recommended configuration for production systems, which should, hopefully, limit this issue to test environments.

MS15-042

The final bulletin this month is a vulnerability affecting Microsoft Hyper-V. When a malicious application is executed in a guest operating system, it could prevent the management of other guest operating systems. This update changes the Virtual Machine Manager’s user input validation logic. As always, VERT recommends that you apply all the patches as soon as possible but also that you fully vet patches (when possible) before applying them to production systems. Ease of Use (published exploits) to Risk Table