====================================================================

                                  CERT-Renater

                      Note d'Information No. 2016/VULN054
_____________________________________________________________________

DATE                : 11/02/2016

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S):  Windows versions Vista, Server 2008, 7, 8.1,
                                 Server 2012, 10.

======================================================================
KB3134811
https://technet.microsoft.com/en-us/library/security/MS16-013
_____________________________________________________________________

Microsoft Security Bulletin MS16-013: Security Update for Windows 
Journal to Address Remote Code Execution (3134811)

Bulletin Number: MS16-013

Bulletin Title: Security Update for Windows Journal to Address Remote Code
Execution

Severity: Critical

KB Article: 3134811

Version: 1.0

Published Date: February 9, 2016

Executive Summary

This security update resolves a vulnerability in Microsoft Windows. The
vulnerability could allow remote code execution if a user opens a
specially crafted Journal file. Users whose accounts are configured to
have fewer user rights on the system could be less impacted than users
who operate with administrative user rights.

This security update is rated Critical for all supported editions of
Windows Vista, Windows 7, Windows 8.1, and Windows 10, for all
supported non-Itanium editions of Windows Server 2008 and Windows
Server 2008 R2, and for all supported editions of Windows Server 2012
and Windows Server 2012 R2.


Affected Software

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows 8.1 for 32-bit Systems

Windows 8.1 for x64-based Systems

Windows Server 2012

Windows Server 2012 R2

Windows 10 for 32-bit Systems[1]

Windows 10 for x64-based Systems[1]

Windows 10 Version 1511 for 32-bit Systems[1]

Windows 10 Version 1511 for x64-based Systems[1]

[1]Windows 10 updates are cumulative. In addition to containing
non-security updates, they also contain all of the security fixes for
all of the Windows 10-affected vulnerabilities shipping with the
monthly security release. The update is available via the Windows
Update Catalog.


Vulnerability Information

Windows Journal Memory Corruption Vulnerability- CVE-2016-0038

A remote code execution vulnerability exists in Microsoft Windows when
a specially crafted Journal file is opened in Windows Journal. An
attacker who successfully exploited this vulnerability could cause
arbitrary code to execute in the context of the current user. If a user
is logged on with administrative user rights, an attacker could take
control of the affected system. An attacker could then install
programs; view, change, or delete data, or create new accounts with
full user rights. Users whose accounts are configured to have fewer
user rights on the system could be less impacted than users who operate
with administrative user rights.

For an attack to be successful, this vulnerability requires that a user
open a specially crafted Journal file with an affected version of
Windows Journal. In an email attack scenario, an attacker could exploit
the vulnerability by sending a specially crafted Journal file to the
user and then convincing the user to open the file.

The update addresses the vulnerability by modifying how Windows Journal
parses Journal files.

The following table contains links to the standard entry for each
vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability Title 		CVE number 	Publicly disclosed 	Exploited

Windows Journal Memory
Corruption Vulnerability 	CVE-2016-0038 	No 	No

==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================