====================================================================

                              CERT-Renater

                  Note d'Information No. 2015/VULN159
_____________________________________________________________________

DATE                : 19/08/2015

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Microsoft Internet Explorer
                             versions 7, 8, 9, 10, 11.

======================================================================
https://technet.microsoft.com/en-us/library/security/MS15-093
______________________________________________________________________

Microsoft Security Bulletin MS15-093 - Critical Security Update for
Internet Explorer (3088903)

Published: August 18, 2015

Version: 1.0

Executive Summary

This security update resolves a vulnerability in Internet Explorer. The
vulnerability could allow remote code execution if a user views a
specially crafted webpage using Internet Explorer. An attacker who
successfully exploited this vulnerability could gain the same user
rights as the current user. Customers whose accounts are configured to
have fewer user rights on the system could be less impacted than those
who operate with administrative user rights.

This security update is rated Critical for Internet Explorer 7 (IE 7),
Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet
Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected
Windows clients, and Moderate for Internet Explorer 7 (IE 7), Internet
Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE
10), and Internet Explorer 11 (IE 11) on affected Windows servers. For
more information, see the Affected Software section.


Affected Software

Internet Explorer 7

Internet Explorer 8

Internet Explorer 9

Internet Explorer 10

Internet Explorer 11

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

Windows 8 for 32-bit Systems

Windows 8 for x64-based Systems

Windows Server 2012

Windows RT

Windows 8.1 for 32-bit Systems

Windows 8.1 for x64-based Systems

Windows Server 2012 R2

Windows RT 8.1

Windows 10 for 32-bit Systems [2]

Windows 10 for x64-based Systems [2]

[2] The Windows 10 update is cumulative. In addition to containing
non-security updates, it also contains all of the security fixes for
all of the Windows 10-affected vulnerabilities shipping with this
months security release. See Microsoft Knowledge Base Article 3081444
for more information and download links.

Note Windows Server Technical Preview is affected. Customers running
this operating system are encouraged to apply the update, which is
available via Windows Update.


Vulnerability Information

Memory Corruption Vulnerability CVE-2015-2502

A remote code execution vulnerability exists when Internet Explorer
improperly accesses objects in memory. This vulnerability could corrupt
memory in such a way that an attacker could execute arbitrary code in
the context of the current user.

An attacker could host a specially crafted website that is designed to
exploit this vulnerability through Internet Explorer, and then convince
a user to view the website. The attacker could also take advantage of
compromised websites and websites that accept or host user-provided
content or advertisements by adding specially crafted content that
could exploit this vulnerability. In all cases, however, an attacker
would have no way to force users to view the attacker-controlled
content. Instead, an attacker would have to convince users
to take action, typically by getting them to click a link in an instant
messenger or email message that takes users to the attacker's website,
or by getting them to open an attachment sent through email.

An attacker who successfully exploited this vulnerability could gain
the same user rights as the current user. If the current user is logged
on with administrative user rights, an attacker who successfully
exploited this vulnerability could take complete control of an affected
system. An attacker could then install programs; view, change, or
delete data; or create new accounts with full user rights. Systems
where Internet Explorer is used frequently, such as workstations or
terminal servers, are at the most risk from this vulnerability.


=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================