====================================================================

                              CERT-Renater

                   Note d'Information No. 2016/VULN166
_____________________________________________________________________

DATE                : 13/04/2016

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows version 10.

======================================================================
KB3148538
https://technet.microsoft.com/en-us/library/security/MS16-046
_____________________________________________________________________

Microsoft Security Bulletin MS16-046: Security Update for Secondary 
Logon (3148538)

Bulletin Number: MS16-046

Bulletin Title: Security Update for Secondary Logon

Severity: Important

KB Article: 3148538

Version: 1.0

Published Date: April 12, 2016


Executive Summary

This security update resolves a vulnerability in Microsoft Windows. An
attacker who successfully exploited this vulnerability could run
arbitrary code as an administrator.

This security update is rated Important for all supported editions of
Windows 10. For more information, see the Affected Software section.

The security update addresses the vulnerability by correcting how
Windows Secondary Logon Service handles requests in memory.


Affected Software

Windows 10 for 32-bit Systems [1]

Windows 10 for x64-based Systems [1]

Windows 10 for x64-based Systems [1]

Windows 10 Version 1511 for 32-bit Systems [1]

Windows 10 Version 1511 for x64-based Systems [1]

[1]Windows 10 updates are cumulative. The monthly security release
includes all security fixes for vulnerabilities that affect Windows 10,
in addition to non-security updates. The updates are available via the
Microsoft Update Catalog.


Vulnerability Information

Secondary Logon Elevation of Privilege Vulnerability - CVE-2016-0135

An elevation of privilege vulnerability exists in Microsoft Windows
when the Windows Secondary Logon Service fails to properly manage
requests in memory.
An attacker who successfully exploited this vulnerability could run
arbitrary code as an administrator. An attacker could then install
programs; view, change, or delete data; or create new accounts with
full user rights.

To exploit this vulnerability, an attacker must first log on to the
system. An attacker could then run a specially crafted application that
could exploit the vulnerability and take control of an affected system.
The security update addresses the vulnerability by correcting how the
Windows Secondary Logon Service handles requests in memory.

The following table contains a link to the standard entry for each
vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability Title     CVE number     Publicly disclosed   Exploited

Secondary Logon Elevation
of Privilege Vulnerability   CVE-2016-0135    Yes            No


==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================