====================================================================

                               CERT-Renater

                   Note d'Information No. 2016/VULN346
_____________________________________________________________________

DATE                : 14/10/2016

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows versions Vista, 7, 8.1, RT 8.1, 10
                          running Microsoft Video Control.

=====================================================================
KB3195360
https://technet.microsoft.com/en-us/library/security/MS16-122
____________________________________________________________________

Microsoft Security Bulletin MS16-122 - Critical Security Update for 
Microsoft Video Control (3195360)

Published: October 11, 2016

Version: 1.0

Executive Summary

This security update resolves a vulnerability in Microsoft Windows. The
vulnerability could allow remote code execution if Microsoft Video
Control fails to properly handle objects in memory. An attacker who
successfully exploited the vulnerability could run arbitrary code in
the context of the current user. However, an attacker must first
convince a user to open either a specially crafted file or a program
from either a webpage or an email message.

This security update is rated Critical on the following client
operating systems: Microsoft Windows Vista, Windows 7, Windows 8.1,
Windows RT 8.1, and Windows 10. For more information, see the Affected
Software section.

The update addresses the vulnerability by correcting how Microsoft
Video Control handles objects in memory.


Affected Software

Windows Vista

Windows 7

Windows 8.1

Windows RT 8.1

Windows 10


Vulnerability Information

Microsoft Video Control Remote Code Execution Vulnerability CVE-2016-0142

A remote code execution vulnerability exists when Microsoft Video
Control fails to properly handle objects in memory. An attacker who
successfully exploited the vulnerability could run arbitrary code in
the context of the current user. If the current user is logged on with
administrative user rights, an attacker could take control of the
affected system. An attacker could then install programs; view, change,
or delete data; or create new accounts with full user rights. Users
whose accounts are configured to have fewer user rights on the system
could be less impacted than users who operate with administrative user
rights.

To exploit the vulnerability, an attacker would have to convince a user
to open either a specially crafted file or application from either a
webpage or an email message. The update addresses the vulnerability by
correcting how Microsoft Video Control handles objects in memory.

Note that where the severity is indicated as Critical in the Affected
Software and Vulnerability Severity Ratings table, the Preview Pane is
an attack vector for CVE-2016-0142.

The following table contains links to the standard entry for each
vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability title	CVE number	Publicly disclosed	Exploited

Microsoft Video Control Remote
Code Execution Vulnerability	CVE-2016-0142	No		No


==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================