====================================================================

                           CERT-Renater

               Note d'Information No. 2015/VULN147
_____________________________________________________________________

DATE                : 15/07/2015

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows versions Vista, Server 2008, Server 2012, 7,
                              8, 8.1, RT 8.1.

======================================================================
KB3072631
https://technet.microsoft.com/en-us/library/security/MS15-069
______________________________________________________________________

Microsoft Security Bulletin MS15-069 Important: Vulnerabilities in
Windows Could Allow Remote Code Execution (3072631)

Bulletin Number: MS15-069

Bulletin Title: Vulnerabilities in Windows Could Allow Remote Code Execution

Severity: Important

KB Article: 3072631

Version: 1.0

Published Date: July 14, 2015


Executive Summary

This security update resolves vulnerabilities in Microsoft Windows. The
vulnerabilities could allow Remote Code Execution if an attacker first
places a specially crafted dynamic link library (DLL) file in the target
users current working directory and then convinces the user to open an
RTF file or to launch a program that is designed to load a trusted DLL
file but instead loads the attackers specially crafted DLL file. An
attacker who successfully exploited the vulnerabilities could take
complete control of an affected system. An attacker could then install
programs; view, change, or delete data;
or create new accounts with full user rights.

This security update is rated Important for all supported editions of
Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2
(excluding Itanium), Windows 8.1, Windows 2012 R2, and Windows RT 8.1.
For more information, see the Affected Software
section.


Affected Software

Windows Vista

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7

Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2

Windows Server 2008 R2 for x64-based Systems Service Pack 1[1]

Windows 8.1

Windows 8.1 for 32-bit Systems

Windows 8.1 for x64-based Systems

Windows Server 2012 R2

Windows Server 2012 R2

Windows RT 8.1

Windows RT 8.1[2]

[1]Windows Server 2008 R2 systems are affected only if Desktop
Experience is installed.

[2]This update is available via Windows Update only.


Windows DLL Remote Code Execution Vulnerability - CVE-2015-2368

A remote code execution vulnerability exists when Microsoft Windows
improperly handles the loading of dynamic link library (DLL) files. An
attacker who successfully exploited the vulnerability could take
complete control of an affected system. An attacker could then install
programs; view, change, or delete data; or create new accounts with full
user rights.

To exploit the vulnerability, an attacker would first have to place a
specially crafted DLL file in the target users current working directory
and then convince the user to launch a program that is designed to load
a trusted DLL file but instead loads the attackers specially crafted DLL
file. The update addresses the vulnerability by correcting how Windows
handles the loading of certain DLL files.

Microsoft received information about this vulnerability through
coordinated vulnerability disclosure. When this security bulletin was
issued, Microsoft had not received any information to indicate that this
vulnerability had been publicly used to attack customers.

DLL Planting Remote Code Execution Vulnerability - CVE-2015-2369

A remote code execution vulnerability exists when Microsoft Windows
Media Device Manager improperly handles the loading of certain specially
crafted DLL files. An attacker who successfully exploited this
vulnerability could take complete control of an affected system. An
attacker could then install programs; view, change, or delete data; or
create new accounts with full user rights.

To exploit this vulnerability, an attacker would first have to place a
specially crafted DLL file in the target users current working directory
and then convince the user to open a specially crafted .RTF file. The
attacker would have no way to force users to open the file. The update
addresses the vulnerability by correcting how the Windows Media Device
Manager loads certain binaries.

Microsoft received information about this vulnerability through
coordinated vulnerability disclosure. When this security bulletin was
issued, Microsoft had not received any information to indicate that this
vulnerability had been
publicly used to attack customers.

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================