====================================================================

                           CERT-Renater

               Note d'Information No. 2015/VULN152
_____________________________________________________________________

DATE                : 15/07/2015

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows version Server 2003, Vista, Server 2008, 7,
       8, 8.1, Server 2012, RT, RT 8.1 running Windows Installer Service.

======================================================================
KB3072630
https://technet.microsoft.com/en-us/library/security/MS15-074
______________________________________________________________________

Microsoft Security Bulletin MS15-074: Vulnerability in Windows Installer
Service Could Allow Elevation of Privilege (3072630)

Bulletin Number: MS15-074

Bulletin Title: Vulnerability in Windows Installer Service Could Allow
Elevation of Privilege

Severity: Important

KB Article: 3072630

Version: 1.0

Published Date: July 14, 2015


Executive Summary

This security update resolves a vulnerability in Microsoft Windows. The
vulnerability could allow elevation of privilege if the Windows
Installer service improperly runs custom action scripts. An attacker
must first compromise a user who is logged on to the target system to
exploit the vulnerability. An attacker could then install programs;
view, change, or delete data; or create new accounts with full
administrative rights.

This security update is rated Important for all supported editions of
Microsoft Windows. For more information, see the Affected Software section.

Affected Software

Windows Server 2003

Windows Server 2003 Service Pack 2[1]

Windows Server 2003 R2 Service Pack 2[1]

Windows Server 2003 x64 Edition Service Pack 2[1]

Windows Server 2003 R2 x64 Edition Service Pack 2[1]

Windows Server 2003 with SP2 for Itanium-based Systems[1]

Windows Vista

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7

Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

Windows 8 and Windows 8.1

Windows 8 for 32-bit Systems

Windows 8 for x64-based Systems

Windows 8.1 for 32-bit Systems

Windows 8.1 for x64-based Systems

Windows Server 2012 and Windows Server 2012 R2

Windows Server 2012

Windows Server 2012 R2

Windows RT and Windows RT 8.1

Windows RT[2]

Windows RT 8.1[2]

Server Core installation option

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core
installation)

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core
installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core
installation)

Windows Server 2012 (Server Core installation)

Windows Server 2012 R2 (Server Core installation)

[1]This update is for systems that have the 3072630 update installed.
See the
Update FAQ for more information.

[2]This update is available via Windows Update only.


Windows Installer EoP Vulnerability - CVE-2015-2371

An elevation of privilege vulnerability exists in some cases in the
Windows Installer service when it improperly runs custom action scripts.
An attacker who successfully exploited this vulnerability could elevate
privileges on a targeted system. An attacker could then install
programs; view, change, or delete data; or create new accounts with full
administrative rights.

To exploit the vulnerability, an attacker must first compromise a user
who is logged on to the target system, then find a vulnerable .msi
package that is installed on the target system and, finally, place
specially crafted code on the target system that the vulnerable .msi
package can execute.

Microsoft received information about this vulnerability through
coordinated vulnerability disclosure. When this security bulletin was
issued, Microsoft had not received any information to indicate that this
vulnerability had been publicly used to attack customers.

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================