====================================================================

                            CERT-Renater

                Note d'Information No. 2015/VULN177
_____________________________________________________________________

DATE                : 09/09/2015

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows version Vista, 7, 8, 8.1 running Windows
                                     Media Center.

======================================================================
KB3087918
https://technet.microsoft.com/en-us/library/security/MS15-100
______________________________________________________________________

Microsoft Security Bulletin MS15-100: Vulnerability in Windows Media 
Center Could Allow Remote Code Execution (3087918)

Bulletin Number: MS15-100

Bulletin Title: Vulnerability in Windows Media Center Could Allow Remote 
Code Execution

Severity: Important

KB Article: 3087918

Version: 1.0

Published Date: September 8, 2015

Executive Summary

This security update resolves a vulnerability in Microsoft Windows. The
vulnerability could allow remote code execution if Windows Media Center
opens a specially crafted Media Center link (.mcl) file that references
malicious code. An attacker who successfully exploited this
vulnerability could gain the same user rights as the current user.
Customers whose accounts are configured to have fewer user rights on
the system could be less impacted than those who operate with
administrative user rights.

This security update is rated Important for all supported editions of
Windows Media Center when installed on Windows Vista, Windows 7,
Windows 8, or Windows 8.1. For more information, see the Affected
Software section.


Affected Software

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems Service Pack 1

Windows 8 for 32-bit Systems

Windows 8 for x64-based Systems

Windows 8.1 for 32-bit Systems

Windows 8.1 for x64-based Systems


Vulnerability Information

Windows Media Center RCE Vulnerability - CVE-2015-2509

A vulnerability exisits in Windows Media Center that could allow remote
code execution if Windows Media Center opens a specially crafted Media
Center link (.mcl) file that references malicious code. An attacker who
successfully exploited this vulnerability could gain the same user
rights as the current user. Customers whose accounts are configured to
have fewer user rights on the system could be less impacted than users
who operate with administrative user rights.

To exploit this vulnerability, an attacker must entice a user to
install the .mcl file on the local machine. Malicious code referenced
by the .mcl file could then be executed from an attacker-controlled
location. The security update addresses the vulnerability by correcting
how Media Center link files are handled.

Microsoft received information about this vulnerability through
coordinated vulnerability disclosure. When this security bulletin was
originally issued Microsoft had not received any information to
indicate that this vulnerability had been publicly used to attack
customers.

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================