====================================================================

                           CERT-Renater

               Note d'Information No. 2015/VULN079
_____________________________________________________________________

DATE                : 13/05/2015

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows version Server 2003, Vista, Server 2008
                     running JScript and VBScript Scripting Engines.

======================================================================
KB3057263
https://technet.microsoft.com/en-us/library/security/MS15-053
______________________________________________________________________


MS15-053: Vulnerabilities in JScript and VBScript Scripting Engines
Could Allow Security Feature Bypass (3057263)

Bulletin Number: MS15-053

Bulletin Title: Vulnerabilities in JScript and VBScript Scripting
Engines Could Allow Security Feature Bypass

Severity: Important

KB Article: 3057263

Version: 1.0

Published Date: May 12, 2015


Executive Summary

This security update resolves ASLR security feature bypasses in the
JScript and VBScript scripting engines in Microsoft Windows. An
attacker could use one of these ASLR bypasses in conjunction with
another vulnerability, such as a remote code execution vulnerability,
to more reliably run arbitrary code on a target system.

This security update is rated Important for affected versions of the
JScript and VBScript scripting engines on supported editions of Windows
Server 2003, Windows Vista, Windows Server 2008, and Server Core
installations of Windows Server 2008 R2. For more information, see the
Affected Software section.


Affected Software

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core
installation)

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core
installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core
installation)


Vulnerability Information

VBScript ASLR Bypass - CVE-2015-1684

A security feature bypass exists when the VBScript engine fails to use
the Address Space Layout Randomization (ASLR) security feature,
allowing an attacker to more reliably predict the memory offsets of
specific instructions in a given call stack. The security feature
bypass by itself does not allow arbitrary code execution. However, an
attacker could use the ASLR bypass in conjunction with another
vulnerability, such as a remote code execution vulnerability, to more
reliably run arbitrary code on a target system.

In a web-browsing scenario, successful exploitation of an ASLR bypass
requires that a user is logged on and running an affected version of
Internet Explorer, and browses to a malicious site. Therefore, any
systems where a web browser is used frequently, such as workstations or
terminal servers, are at the most risk from ASLR bypasses. Servers
could be at more risk if administrators allow users to browse and read
email on servers. However, best practices strongly discourage allowing
this.

The update addresses this ASLR bypass by helping to ensure that
affected versions of VBScript properly implement the ASLR security
feature.


VBScript and JScript ASLR Bypass - CVE-2015-1686

A security feature bypass exists when the JScript and VBScript engines
fail to use the Address Space Layout Randomization (ASLR) security
feature, allowing an attacker to more reliably predict the memory
offsets of specific instructions in a given call stack. The security
feature bypass by itself does not allow arbitrary code execution.
However, an attacker could use the ASLR bypass in conjunction with
another vulnerability, such as a remote code execution vulnerability,
to more reliably run arbitrary code on a target system.

In a web-browsing scenario, successful exploitation of an ASLR bypass
requires that a user is logged on and running an affected version of
Internet Explorer, and browses to a malicious site. Therefore, any
systems where a web browser is used frequently, such as workstations or
terminal servers, are at the most risk from ASLR bypasses. Servers
could be at more risk if administrators allow
users to browse and read email on servers. However, best practices
strongly discourage allowing this.

The update addresses this ASLR bypass by helping to ensure that
affected versions of JScript and VBScript properly implement the ASLR
security feature.

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================