VERT Threat Alert: July 2016 Patch Tuesday Analysis

Image

Today’s VERT Alert addresses 11 new Microsoft Security Bulletins. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expects to ship ASPL-680 on Wednesday, July 13th.

Ease of Use (published exploits) to Risk Table

MS16-084

This month starts off like most others, with an update that resolves 15 vulnerabilities in Internet Explorer. In a rare occurrence, none of these vulnerabilities have been disclosed publicly this month. Once again, a number of the vulnerabilities overlap with the Microsoft Edge vulnerabilities resolved by MS16-085.

MS16-085

Following the Internet Explorer update, we have the Microsoft Edge update, which contains quite a bit of overlap with the MS16-084 bulletin and only a few unique vulnerabilities. Like Internet Explorer, none of these vulnerabilities were publicly disclosed.

MS16-086

Next, we have an update to JScript and VBScript, another monthly regular lately. You’ll notice overlap with the Internet Explorer. This update only applies to users without Internet Explorer or with IE7 installed; all other users are covered after installing the Internet Explorer update (MS16-084).

MS16-087

One of the more unique bulletins this month is MS16-086, resolving a pair of vulnerabilities affecting the Windows Print Spooler, which hasn’t seen an update in several years. One of these vulnerabilities allows a malicious print server or MitM to install malicious print drivers. The update addresses the vulnerability by issuing a warning to users attempting to install untrusted drivers. This is important to note, as the bulletin does not state that it prevents the installation of these drivers. This means that user education should be associated with this update.

MS16-088

A number of vulnerabilities in both the Microsoft Office Suite and Microsoft Office WebApps are addressed in this bulletin. One of the more important points to pay attention to is the mention that several of the vulnerabilities can be exploited via the Preview Pane. Thankfully, none of the vulnerabilities in this bulletin have been publicly disclosed or exploited.

MS16-089

This next bulletin describes a single information disclosure vulnerability that only affects Windows 10, allowing someone logged into the system to access sensitive information.

MS16-090

Another monthly regular, the Windows Kernel-Mode Drivers bulletin resolves a number of vulnerabilities impacting Win32k.

MS16-091

While we frequently see .NET in the monthly bulletin summary, we rarely see it contain only a single information disclosure vulnerability. The vulnerability could allow an attacker to read files, if they can find an application that will parse their malicious XML file.

MS16-092

A pair of vulnerabilities affecting the Windows Kernel are resolved by MS16-092. CVE-2016-3272 has been publicly disclosed.

MS16-093

The penultimate update this month, MS16-093, is actually APSB16-025 in disguise and references a number of Adobe Flash Player vulnerabilities.

MS16-094

We end the month with an update to Secure Boot that resolves a vulnerability affecting Windows 8.1 and newer. Given that this vulnerability was disclosed publicly and the bulletin was included after Flash Player, which is traditionally the final bulletin of the month, Microsoft may have moved quickly to release this patch. If that is true, thoroughly test this patch before deploying it in your environment. CVE-2016-3287 has been publicly disclosed.

Additional Details

Adobe has released APSB16-25 for Flash Player and APSB16-26 for Acrobat and Reader. As always, VERT recommends that you apply all the patches as soon as possible but also that you fully vet patches (when possible) before applying them to production systems.