====================================================================

                           CERT-Renater

               Note d'Information No. 2015/VULN154
_____________________________________________________________________

DATE                : 15/07/2015
OLE objects HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows version Server 2003, Vista, Server 2008, 7,
                 8, 8.1, Server 2012, RT, RT 8.1 running Windows RPC.

======================================================================
KB3067505
https://technet.microsoft.com/en-us/library/security/MS15-076
______________________________________________________________________

Microsoft Security Bulletin MS15-076 Important: Vulnerability in Windows
Remote Procedure Call Could Allow Elevation of Privilege (3067505)

Bulletin Number: MS15-076

Bulletin Title: Vulnerability in Windows Remote Procedure Call Could
Allow Elevation of Privilege

Severity: Important

KB Article: 3067505

Version: 1.0

Published Date: July 14, 2015


Executive Summary

This security update resolves a vulnerability in Microsoft Windows. The
vulnerability, which exists in Windows Remote Procedure Call (RPC)
authentication, could allow elevation of privilege if an attacker logs
on to an affected system and runs a specially crafted application. An
attacker who successfully exploited this vulnerability could take
complete control of the affected system. An attacker could then install
programs; view, change, or delete data; or create new accounts with full
user rights.

This security update is rated Important for all supported releases of
Windows. For more information, see the Affected Software section.


Affected Software

Windows Server 2003

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Server 2003 R2 Service Pack 2

Windows Server 2003 R2 x64 Edition Service Pack 2

Windows Vista

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7

Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

Windows 8 and Windows 8.1

Windows 8 for 32-bit Systems

Windows 8 for x64-based Systems

Windows 8.1 for 32-bit Systems

Windows 8.1 for x64-based Systems

Windows Server 2012 and Windows Server 2012 R2

Windows Server 2012

Windows Server 2012 R2

Windows RT and Windows RT 8.1

Windows RT[1]

Windows RT 8.1[1]

Server Core installation option Windows Server 2008 for 32-bit Systems
Service
Pack 2 (Server Core installation)

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core
installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core
installation)

Windows Server 2012 (Server Core installation)

Windows Server 2012 R2 (Server Core installation)

[1]This update is available via Windows Update only.


Vulnerability Information

Windows RPC Elevation of Privilege Vulnerability - CVE-2015-2370

An elevation of privilege vulnerability exists in the Microsoft Remote
Procedure Call (RPC) that could allow an attacker to elevate privileges
on a targeted system. The vulnerability is caused when Windows RPC
inadvertently allows DCE/RPC connection reflection.

An attacker who successfully exploited this vulnerability could take
complete control of the affected system. An attacker could then install
programs; view, change, or delete data; or create new accounts with full
user rights. To exploit this vulnerability, an attacker would first have
to log on to the system. An attacker could then run a specially crafted
application designed to
elevate privileges.

The update addresses the vulnerability by improving how Windows RPC
handles authentication checks to preclude redirection.

Microsoft received information about this vulnerability through
coordinated vulnerability disclosure. When this security bulletin was
issued, Microsoft had not received any information to indicate that this
vulnerability had been publicly used to attack customers.

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================