====================================================================

                           CERT-Renater

               Note d'Information No. 2015/VULN144
_____________________________________________________________________

DATE                : 15/07/2015

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows versions Server 2003, Vista, Server 2008
                             running VBScript Scripting Engine.

======================================================================
KB3072604
https://technet.microsoft.com/en-us/library/security/MS15-066
______________________________________________________________________

Microsoft Security Bulletin MS15-066 Vulnerability in VBScript Scripting
Engine Could Allow Remote Code Execution (3072604)

Bulletin Number: MS15-066

Bulletin Title: Vulnerability in VBScript Scripting Engine Could Allow
Remote Code Execution

Severity: Critical

KB Article: 3072604

Version: 1.0

Published Date: July 14, 2015


Executive Summary

This security update resolves a vulnerability in the VBScript scripting
engine in Microsoft Windows. The vulnerability could allow remote code
execution if a user visits a specially crafted website. An attacker who
successfully exploited this vulnerability could gain the same user
rights as the current user. If the current user is logged on with
administrative user rights, an attacker who successfully exploited this
vulnerability could take complete control of an affected system. An
attacker could then install programs; view, change, or delete data; or
create new accounts with full user rights.

This security update is rated Critical for affected versions of the
VBScript scripting engine on affected Windows clients, and Moderate for
affected versions of the VBScript scripting engine on affected Windows
servers. For more information, see the Affected Software section.


Affected Software

Windows Server 2003

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

Server Core installation

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core
installation)

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core
installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core
installation)


Vulnerability Information

VBScript Memory Corruption Vulnerability - CVE-2015-2372

A remote code execution vulnerability exists in the way that the
VBScript engine, when rendered in Internet Explorer, handles objects in
memory. In a web-based attack scenario, an attacker could host a
specially crafted website that is designed to exploit this vulnerability
through Internet Explorer and then convince a user to view the website.
An attacker could also embed an ActiveX control marked "safe for
initialization" in an application or Microsoft Office document that
hosts the IE rendering engine. The attacker could also take advantage of
compromised websites and websites that accept or host user-provided
content or advertisements. These websites could contain specially
crafted content that could exploit this vulnerability.

An attacker who successfully exploited this vulnerability could gain the
same user rights as the current user. If the current user is logged on
with administrative user rights, an attacker who successfully exploited
this vulnerability could take complete control of an affected system. An
attacker could then install programs; view, change, or delete data; or
create new accounts with full user rights. The update addresses the
vulnerability by modifying how the VBScript scripting engine handles
objects in memory.

Microsoft received information about this vulnerability through
coordinated vulnerability disclosure. When this security bulletin was
originally issued, Microsoft had not received any information to
indicate that this vulnerability had been publicly used to attack customers.

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================