====================================================================

                            CERT-Renater

                Note d'Information No. 2015/VULN175
_____________________________________________________________________

DATE                : 09/09/2015

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows version Vista, 7, 8, 8.1, 10, RT, Server
                                          2008.

======================================================================
KB3089669
https://technet.microsoft.com/en-us/library/security/MS15-098
______________________________________________________________________

Microsoft Security Bulletin MS15-098: Vulnerabilities in Windows
Journal Could Allow Remote Code Execution (3089669)

Bulletin Number: MS15-098

Bulletin Title: Vulnerabilities in Windows Journal Could Allow Remote 
Code Execution

Severity: Critical

KB Article: 3089669

Version: 1.0

Published Date: September 8, 2015


Executive Summary

This security update resolves vulnerabilities in Microsoft Windows. The 
more severe of the vulnerabilities could allow remote code execution if 
a user opens a specially crafted Journal file. Users whose accounts are 
configured to have fewer user rights on the system could be less 
impacted than users who operate with administrative user rights.

This security update is rated Critical for all supported releases of 
Windows excluding Itanium editions, which are not affected. For more 
information, see the Affected Software section.


Affected Software

Windows Vista Service Pack 2 Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows 8 for 32-bit Systems

Windows 8 for x64-based Systems

Windows 8.1 for 32-bit Systems

Windows 8.1 for x64-based Systems

Windows Server 2012

Windows Server 2012 R2

Windows RT[1]

Windows RT 8.1[1]

Windows 10 for 32-bit Systems[2]

Windows 10 for x64-based Systems[2]


Vulnerability Information

Multiple Windows Journal RCE Vulnerabilities

Remote code execution vulnerabilities exist in Microsoft Windows when a
specially crafted Journal file is opened in Windows Journal. An
attacker who https://technet.microsoft.com/en-us/library/security/MS15-098

successfully exploited the vulnerabilities could cause arbitrary code
to execute in the context of the current user. If a user is logged on
with administrative user rights, an attacker could take control of the
affected system. An attacker could then install programs; view, change,
or delete data; or create new accounts with full user rights. Users
whose accounts are configured to have fewer user rights on the system
could be less impacted than users who operate with administrative user
rights.

For an attack to be successful, the vulnerabilities require that a user
open a specially crafted Journal file with an affected version of
Windows Journal. In an email attack scenario, an attacker could exploit
the vulnerabilities by sending a specially crafted Journal file to the
user and by convincing the user to open the file. The update addresses
the vulnerabilities by modifying how Windows Journal parses Journal
files.

The update addresses the vulnerabilities by modifying how Internet
Explorer handles objects in memory. The following table contains links
to the standard entry for each vulnerability in the Common
Vulnerabilities and Exposures list:

Vulnerability title  CVE number        Publicly disclosed  Exploited

Windows Journal RCE Vulnerability  CVE-2015-2513 No 		No

Windows Journal RCE Vulnerability  CVE-2015-2514 No 		No

Windows Journal Integer Overflow   CVE-2015-2519 No 		No
  RCE Vulnerability

Windows Journal RCE Vulnerability  CVE-2015-2530 No 		No
Unsolicited port scanning has been detected from a machine on your
network using IP address: 193.50.192.37

Windows Journal DoS Vulnerability - CVE-2015-2516

A denial of service vulnerability exists in Windows Journal when a
specially crafted Journal file is opened in Windows Journal. An
attacker who successfully exploited this vulnerability could cause data
loss on the target system. Note that the denial of service would not
allow an attacker to execute code or to elevate their user rights.

For an attack to be successful, a user must open a specially crafted
Journal file with an affected version of Windows Journal. In an email
attack scenario, an attacker could exploit the vulnerability by sending
a specially crafted Journal file to the user and by convincing the user
to open the file. The update addresses the vulnerability by correcting
how Windows Journal manages objects in memory.

Microsoft received information about this vulnerability through
coordinated vulnerability disclosure. When this security bulletin was
issued, Microsoft had not received any information to indicate that
this vulnerability had been publicly used to attack customers.


=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================