Patch Tuesday Closes Zero Days

Thursday, April 16, 2015 @ 03:04 PM gHale

April’s Patch Tuesday had Microsoft releasing 11 security bulletins, four of which rated critical and addressed 26 vulnerabilities.

All four critical security updates resolve remote code execution (RCE) vulnerabilities.

Patch Tuesday Features FREAK Focus
Big Patch Tuesday Update
Alter One Bit, Bypass Security
Microsoft: Control System Warning

MS15-033 addresses a Zero Day vulnerability in Microsoft Office, which is currently under limited attacks on Word 2010. Although Microsoft said to exploit the RCE vulnerability, an attacker must get a user to open a specially crafted Office file.

This vulnerability rates as critical for Microsoft Word 2007, Microsoft Office 2010, Microsoft Word 2010, Microsoft Office Web Apps Server 2010, Microsoft Word Viewer, Microsoft Office Compatibility Pack and Word Automation Services on Microsoft SharePoint Server 2010.

MS15-033 also fixes two critical RCE flaws that could end up exploited in Office 2007 and 2010 if the user simply looks at an email in the Outlook preview pane.

MS15-034 resolves a vulnerability in HTTP.sys. This ended up rated critical for all supported editions of Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, and Windows Server 2012 R2. Although Microsoft doesn’t add much more than that.

MS15-032 fixes 10 security holes in Internet Explorer, nine of which end up rated critical. If IE is on your PC, then you need this patch as IE6 to IE11 are vulnerable without it.

MS15-035 closes an RCE flaw in Microsoft graphics component, specifically in the Enhanced Metafile (EMF) file format that could end up exploited if an attacker convinces a user to browse a maliciously crafted site, file, or browse to a working directory that contains a specially crafted EMF image file.

APS15-06 is also critical to patch Adobe Flash Player as CVE-2015-3043 is currently suffering exploitation in the wild.

MS15-036 for Microsoft SharePoint Server, MS15-037 for Windows Task Scheduler and MS15-038 for Microsoft Windows all ended up rated as important fixes for Elevation of Privilege (EoP) flaws.

MS15-039 resolves a security feature bypass vulnerability in Microsoft XML Core Services 3.0 and all supported editions of Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2. Microsoft said the patch corrects “how Microsoft XML Core services enforces the same-origin policy in a document type declaration (DTD) scenario.”

The next two Microsoft security updates address information disclosure bugs. Microsoft said MS15-040 resolves a hole in “Active Directory Federation Services (AD FS). The vulnerability could allow information disclosure if a user leaves their browser open after logging off from an application and an attacker reopens the application in the browser immediately after the user has logged off.” MS15-041 patches a flaw in Microsoft .NET Framework.

MS15-042 provides the fix for Microsoft Windows Hyper-V that “could allow denial of service if an authenticated attacker runs a specially crafted application in a virtual machine (VM) session.”

Leave a Reply

You must be logged in to post a comment.