====================================================================

                              CERT-Renater

                   Note d'Information No. 2016/VULN167
_____________________________________________________________________

DATE                : 13/04/2016

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows versions Vista, Server 2008, 7, 8.1,
                       Server 2012, RT 8.1, 10.

======================================================================
KB3148527
https://technet.microsoft.com/en-us/library/security/MS16-047
_____________________________________________________________________

Microsoft Security Bulletin MS16-047: Security Update for SAM and LSAD 
Remote Protocols (3148527)

Bulletin Number: MS16-047

Bulletin Title: Security Update for SAM and LSAD Remote Protocols

Severity: Important

KB Article: 3148527

Version: 1.0

Published Date: April 12, 2016

Executive Summary

This security update resolves a vulnerability in Microsoft Windows. The
vulnerability could allow elevation of privilege if an attacker
launches a man-in-the-middle (MiTM) attack. An attacker could then
force a downgrade of the authentication level of the RPC channel and
impersonate an authenticated user.

This security update is rated Important for all supported editions of
Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2,
Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 
8.1, and Windows 10.


Affected Software

Windows Vista Service Pack 2(3149090)

Windows Vista x64 Edition Service Pack 2(3149090)

Windows Server 2008 for 32-bit Systems Service Pack 2(3149090)

Windows Server 2008 for x64-based Systems Service Pack 2(3149090)

Windows Server 2008 for Itanium-based Systems Service Pack 2(3149090)

Windows 7 for 32-bit Systems Service Pack 1(3149090)

Windows 7 for x64-based Systems Service Pack 1(3149090)

Windows Server 2008 R2 for x64-based Systems Service Pack 1(3149090)

Windows Server 2008 R2 for Itanium-based Systems Service Pack 1(3149090)

Windows 8.1 for 32-bit Systems(3149090)

Windows 8.1 for x64-based Systems(3149090)

Windows Server 2012(3149090)

Windows Server 2012 R2(3149090)

Windows RT 8.1[1] (3149090)

Windows 10 for 32-bit Systems[2](3147461)

Windows 10 for x64-based Systems[2](3147461)

Windows 10 Version 1511 for 32-bit Systems[2](3147458)

Windows 10 Version 1511 for x64-based Systems[2](3147458)

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core
installation) (3149090)

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core
installation) (3149090)

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core
installation) (3149090)

Windows Server 2012 (Server Core installation) (3149090)

Windows Server 2012 R2 (Server Core installation) (3149090)

[1]This update is available via Windows Update.

[2]Windows 10 updates are cumulative. The monthly security release
includes all security fixes for vulnerabilities that affect Windows 10,
in addition to non-security updates. The updates are available via the
Microsoft Windows Update Catalog.


Vulnerability Information

Windows RPC Downgrade Vulnerability- CVE-2016-0128

An elevation of privilege vulnerability exists in the Security Account
Manager (SAM) and Local Security Authority (Domain Policy) (LSAD) remote
protocols when they accept authentication levels that do not protect the
RPC channel adequately. The vulnerability is caused by the way the SAM
and LSAD remote protocols establish the Remote Procedure Call (RPC)
channel. An attacker who successfully exploited this vulnerability
could gain access to the SAM database.

To exploit the vulnerability, an attacker could launch a man-in-
the-middle (MiTM) attack, force a downgrade of the authentication level
of the RPC channel, and then impersonate an authenticated user. The
security update addresses the vulnerability by modifying how the SAM
and LSAD remote protocols handle authentication levels.

The following table contains links to the standard entry for each
vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability Title    CVE number      Publicly disclosed   Exploited

Windows RPC Downgrade
Vulnerability        CVE-2016-0128      No                   No



==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================