====================================================================

                                   CERT-Renater

                        Note d'Information No. 2016/VULN248
_____________________________________________________________________

DATE                : 15/06/2016

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Internet Explorer versions 9, 10,
                                      11.

======================================================================
KB3163649
https://technet.microsoft.com/en-us/library/security/MS16-063
____________________________________________________________________


MS16-063 - Cumulative Security Update for Internet Explorer (3163649)

Executive Summary

This security update resolves vulnerabilities in Internet Explorer. The
most severe of the vulnerabilities could allow remote code execution if
a user views a specially crafted webpage using Internet Explorer. An
attacker who successfully exploited the vulnerabilities could gain the
same user rights as the current user. If the current user is logged on
with administrative user rights, an attacker could take control of an
affected system. An attacker could then install programs; view, change,
or delete data; or create new accounts with full user rights.

This security update is rated Critical for Internet Explorer 9 (IE 9),
and Internet Explorer 11 (IE 11) on affected Windows clients, and
Moderate for Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10),
and Internet Explorer 11 (IE 11) on affected Windows servers.


Affected Software

Internet Explorer 9

Internet Explorer 10

Internet Explorer 11


Vulnerability Information

Microsoft Internet Explorer Memory Corruption Vulnerabilities

Remote code execution vulnerabilities exist when Internet Explorer
improperly accesses objects in memory. The vulnerabilities could
corrupt memory in such a way that an attacker could execute arbitrary
code in the context of the current user. An attacker who successfully
exploited the vulnerabilities could gain the same user rights as the
current user. If the current user is logged on with administrative user
rights, the attacker could take control of an affected system. An
attacker could then install programs; view, change, or
delete data; or create new accounts with full user rights.

An attacker could host a specially crafted website that is designed to
exploit the vulnerabilities through Internet Explorer, and then
convince a user to view the website. The attacker could also take
advantage of compromised websites, or websites that accept or host
user-provided content or advertisements, by adding specially crafted
content that could exploit the vulnerabilities. In all cases, however,
an attacker would have no way to force users to view the
attacker-controlled content. Instead, an attacker would have
to convince users to take action, typically by an enticement in an
email or Instant Messenger message, or by getting them to open an
attachment sent through email. The update addresses the vulnerabilities
by modifying how Internet Explorer handles objects in memory.

The following table contains links to the standard entry for each
vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability title  CVE number    Publicly disclosed  Exploited

Internet Explorer Memory
Corruption Vulnerability 	CVE-2016-0199 	No 	No

Internet Explorer Memory
Corruption Vulnerability 	CVE-2016-020 	No 	No

Internet Explorer Memory
Corruption Vulnerability 	CVE-2016-3211 	No 	No


Internet Explorer XSS Filter Vulnerability - CVE-2016-3212

A remote code execution vulnerability exists when the Internet Explorer
XSS Filter does not properly validate JavaScript under specific
conditions. An attacker who exploited the vulnerability could run
arbitrary code with medium-integrity level privileges (the permissions
of the current user).

In a web-based attack scenario, an attacker could host a website in an
attempt to exploit this vulnerability. In addition, compromised
websites and websites that accept or host user-provided content could
contain specially crafted content that could exploit the vulnerability.

However, in all cases an attacker would have no way to force users to
view the attacker-controlled content. Instead, an attacker would have
to convince users to take action. For example, an attacker could trick
users into clicking a link that takes the user to the attacker's site.
The update addresses the vulnerability by fixing how the Internet
Explorer XSS Filter validates JavaScript.

The following table contains links to the standard entry for each
vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability title 	CVE number   Publicly disclosed   Exploited

Internet Explorer XSS
Filter Vulnerability	CVE-2016-3212 	No 	         No


WPAD Elevation of Privilege Vulnerability - CVE-2016-3213

An elevation of privilege vulnerability exists in Microsoft Windows
when the Web Proxy Auto Discovery (WPAD) protocol falls back to a
vulnerable proxy discovery process. An attacker who successfully
exploited this vulnerability could bypass security and gain elevated
privileges on a targeted system.

To exploit the vulnerability, an attacker could respond to NetBIOS name
requests for WPAD. The update addresses the vulnerability by correcting
how Windows handles proxy discovery.

The following table contains links to the standard entry for each
vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability Title  CVE number   Publicly disclosed 	Exploited

WPAD Elevation of
Privilege Vulnerability   CVE-2016-3213    No 		No

==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================