====================================================================

                                  CERT-Renater

                      Note d'Information No. 2016/VULN053
_____________________________________________________________________

DATE                : 11/02/2016

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S):  Cisco ASA Software.

======================================================================
KB3138938
https://technet.microsoft.com/en-us/library/security/MS16-012
_____________________________________________________________________

Bulletin Number: MS16-012

Bulletin Title: Security Update for Microsoft Windows PDF Library to
Address Remote Code Execution

Severity: Critical

KB Article: 3138938

Version: 1.0

Published Date: February 9, 2016


Executive Summary

This security update resolves vulnerabilities in Microsoft Windows. The
more evere of the vulnerabilities could allow remote code execution if
Microsoft Windows PDF Library improperly handles application
programming interface (API) calls, which could allow an attacker to run
arbitrary code on the users system. An attacker who successfully
exploited the vulnerabilities could gain the same user rights as the
current user. Customers whose accounts are configured to have fewer
user rights on the system could be less impacted than those who operate
with administrative user rights. However, an attacker would have no way
to force users to download or open a malicious PDF document.

This security update is rated Critical for all supported editions of
Windows 8.1, Windows Server 2012, Windows Server 2012 R2, and Windows
10.


Affected Software

Windows 8.1 for 32-bit Systems

Windows 8.1 for x64-based Systems

Windows Server 2012

Windows Server 2012 R2

Windows 10 for 32-bit Systems[1]

Windows 10 for x64-based Systems[1]

Windows Server 2012 R2 (Server Core installation)

[1]Windows 10 updates are cumulative. In addition to containing
non-security updates, they also contain all of the security fixes for
all of the Windows 10-affected vulnerabilities shipping with the
monthly security release. The update is available via the Windows
Update Catalog.


Vulnerability Information

Microsoft Windows Reader Vulnerability - CVE-2016-0046

A remote code execution vulnerability exists in Microsoft Windows when a
specially crafted file is opened in Windows Reader. An attacker who
successfully exploited this vulnerability could cause arbitrary code to
execute in the context of the current user. If a user is logged on with
administrative user rights, an attacker could take control of the
affected system. An attacker could then install programs; view, change,
or delete data; or create new accounts with full user rights. Customers
whose accounts are configured to have fewer user rights on the system
could be less impacted than those who operate with administrative user
rights.

For an attack to succeed, a user must open a specially crafted Windows
Reader file with an affected version of Windows Reader. In an email
attack scenario, an attacker would have to convince the user to open a
specially crafted Windows Reader file. The update addresses the
vulnerability by modifying how Windows Reader parses files.

The following table contains links to the standard entry for each
vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability title  CVE number   Publicly disclosed 	Exploited

Microsoft Windows
Reader Vulnerability 	CVE-2016-0046	No 			No


Microsoft PDF Library Buffer Overflow Vulnerability - CVE-2016-0058

A vulnerability exists in Microsoft Windows PDF Library when it
improperly handles application programming interface (API) calls, which
could allow an attacker to run arbitrary code on the users system. An
attacker who successfully exploited this vulnerability could gain the
same user rights as the current user. Customers whose accounts are
configured to have fewer user rights on the system could be less
impacted than those who operate with administrative user rights.

An attacker would have no way to force a user to download or run
malicious code in a PDF document. The update addresses the
vulnerability by changing how memory is handled for API calls to the
PDF Library.

The following table contains links to the standard entry for each
vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability title 	CVE number  Publicly disclosed 	Exploited

Microsoft PDF Library Buffer
Overflow Vulnerability 		CVE-2016-0058	No 	No


==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================