====================================================================

                               CERT-Renater

                     Note d'Information No. 2016/VULN289
_____________________________________________________________________

DATE                : 10/08/2016

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows versions Vista, Server 2008, 7, 8.1,
                         Server 2012, RT 8.1, 10
                       running Microsoft Windows PDF Library.

=====================================================================
KB3182248
https://technet.microsoft.com/en-us/library/security/MS16-102
____________________________________________________________________

Microsoft Security Bulletin MS16-102: Critical Security Update for
Microsoft Windows PDF Library (3182248)


Executive Summary

This security update resolves a vulnerability in Microsoft Windows. The
vulnerability could allow remote code execution if a user views
specially crafted PDF content online or opens a specially crafted PDF
document. An attacker who successfully exploited the vulnerability
could gain the same user rights as the current user. If the current
user is logged on with administrative user rights, an attacker could
take control of an affected system. An attacker could then install
programs; view, change, or delete data; or create new accounts with
full user rights.

This security update is rated Critical for all supported editions of
Windows 8.1, Windows Server 2012, Windows RT 8.1, Windows Server 2012
R2, and Windows 10.


Affected Software

Windows 8.1

Windows Server 2012

Windows Server 2012 R2

Windows RT 8.1 [1]

Windows 10 [2]

Windows Server 2012 R2 (Server Core installation)

[1] This update is only available via Windows Update.

[2] Windows 10 updates are cumulative. The monthly security release
includes all security fixes for vulnerabilities that affect Windows 10,
in addition to non-security updates. The updates are available via the
Microsoft Update Catalog.


Vulnerability Information

Microsoft PDF Remote Code Execution Vulnerability - CVE-2016-3319

A remote code execution vulnerability exists when Microsoft Windows PDF
Library improperly handles objects in memory. The vulnerability could
corrupt memory in a way that enables an attacker to execute arbitrary
code in the context of the current user. An attacker who successfully
exploited the vulnerability could gain the same user rights as the
current user. If the current user is logged on with administrative user
rights, an attacker could take control of an affected system. An
attacker could then install programs; view, change, or delete data; or
create new accounts with full user rights.

To exploit the vulnerability on Windows 10 systems with Microsoft Edge
set as the default browser, an attacker could host a specially crafted
website that contains malicious PDF content and then convince users to
view the website. The attacker could also take advantage of compromised
websites, or websites that accept or host user-provided content or
advertisements, by adding specially crafted PDF content to such sites.
Only Windows 10 systems with Microsoft Edge set as the default browser
can be compromised simply by viewing a website. The browsers for all
other affected operating systems do not automatically render PDF
content, so an attacker would have no way to force
users to view attacker-controlled content. Instead, an attacker would
have to convince users to open a specially crafted PDF document,
typically by way of an enticement in an email or instant message or by
way of an email attachment.
The update addresses the vulnerabilities by modifying how affected
systems handle objects in memory.


The following table contains links to the standard entry for each
vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability title   CVE number   Publicly disclosed 	Exploited

Microsoft PDF Remote
Code Execution Vulnerability 	CVE-2016-3319 	No 	No

==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================