====================================================================

                                CERT-Renater

                   Note d'Information No. 2016/VULN011
_____________________________________________________________________

DATE                : 13/01/2016

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows version Vista, Server 2008, 7, 8, 8.1,
                        Server 2012, RT 8.1, 10,
                       running Windows Kernel-Mode Drivers.

======================================================================
KB3124584
https://technet.microsoft.com/en-us/library/security/MS16-005
_____________________________________________________________________

Microsoft Security Bulletin MS16-005: Security Update for Windows
Kernel-Mode Drivers to Address Remote Code Execution (3124584)

Document Metadata

Bulletin Number: MS16-005

Bulletin Title: Security Update for Windows Kernel-Mode Drivers to
Address Remote Code Execution

Severity: Critical

KB Article: 3124584

Version: 1.0

Published Date: January 12, 2016


Executive Summary

This security update resolves vulnerabilities in Microsoft Windows. The
more severe of the vulnerabilities could allow remote code execution if
a user visits a malicious website.


Affected Software

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

Windows 8 for 32-bit Systems

Windows 8 for x64-based Systems

Windows 8.1 for 32-bit Systems

Windows 8.1 for x64-based Systems

Windows Server 2012

Windows Server 2012 R2

Windows RT 8.1 Windows RT[1]

Windows RT 8.1[1]

Windows 10 for 32-bit Systems[2]

Windows 10 for x64-based Systems[2]

Windows 10 Version 1511 for 32-bit Systems[2]

Windows 10 Version 1511 for x64-based Systems[2]

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core
installation)

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core
installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server
Core installation)

Windows Server 2012 (Server Core installation)

Windows Server 2012 R2 (Server Core installation)

[1] This update is only available via Windows Update.

[2] Windows 10 updates are cumulative. In addition to containing
non-security updates, they also contain all of the security fixes for
all of the Windows 10-affected vulnerabilities shipping with the
monthly security release. The update is available via the Windows
Update Catalog.


Vulnerability Information

Windows GDI32.dll ASLR Bypass Vulnerability - CVE-2016-0008

A security feature bypass vulnerability exists in the way that the
Windows graphics device interface handles objects in memory, allowing
an attacker to retrieve information that could lead to an Address Space
Layout Randomization (ASLR) bypass.

To exploit this vulnerability, in a web-based attack scenario, an
attacker could host a specially crafted website that is designed to
exploit the vulnerability through Internet Explorer and then convince
users to view the website. This could also include compromised websites
or websites that accept or host user-provided content or banner
advertisements; such websites could contain specially crafted content
that is designed to exploit the vulnerability. In all cases, however,
an attacker would have no way to force users to visit such websites.
Instead, an attacker would have to convince users to do so, typically
by getting them to click a link in an email or Instant Messenger
request.

In an email attack scenario, an attacker could exploit the
vulnerability by sending Outlook users a specially crafted email, or
sending them a specially crafted Office document as an attachment, and
convincing the user to read the message or open the file.

An attacker could also exploit this vulnerability by hosting a
malicious file on a network share and convincing users to navigate to
the folder in Windows Explorer. The security update addresses the
vulnerability by correcting how the Windows graphics device interface
handles memory addresses, thereby helping to protect the integrity of
the ASLR security feature.

Microsoft received information about this vulnerability through
coordinated vulnerability disclosure. At the time this security
bulletin was originally issued, Microsoft was unaware of any attack
attempting to exploit this vulnerability.

Win32k Remote Code Execution Vulnerability - CVE-2016-0009

A remote code execution vulnerability exists in the way that Windows
handles objects in memory. An attacker who successfully exploited this
vulnerability could run arbitrary code on a target system.

To exploit this vulnerability, an attacker would first have to convince
a user to visit a malicious website that could exploit the
vulnerability and run arbitrary code with the logged on users
privileges. The security update addresses this vulnerability by
correcting how Windows handles objects in memory.

This vulnerability has been publicly disclosed. It has been assigned
Common Vulnerability and Exposure number CVE-2016-0009. At the time
this security bulletin was originally issued, Microsoft was unaware of
any attack attempting to exploit this vulnerability.

==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================