VERT Threat Alert: June 2015 Patch Tuesday Analysis

Image

Today’s VERT Alert addresses 8 new Microsoft Security Bulletins. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expect to ship ASPL-618 on Wednesday, June 10th.  

MS15-056

This month starts like most with a cumulative update for Internet Explorer. While most of the vulnerabilities are standard fare, the publicly disclosed information disclosure vulnerability stands out. CVE-2015-1765 allows an attacker to access your browser history when you visit a malicious website that they control. While the worst-case scenario isn’t as bad as other vulnerabilities in this bundle, this attack is potentially easier to execute.

MS15-057

The second update this month resolves a single vulnerability affecting Windows Media Player versions 10 through 12 across Windows Server 2008 R2 and older operating systems. The result of visiting a website with a malicious DataObject is code execution in the context of the logged in user.

MS15-059

Up next, we have a patch that resolves three vulnerabilities in Microsoft Office. These issues affect the Microsoft Office Compatibility Pack, Office 2010 and Office 2013. Microsoft has included an important reminder that people often forget: While the bulletin states Microsoft Office, any individual Microsoft Office product fits that category, so even if you only have Microsoft Word installed, you could be offered this update.

MS15-060

The single Microsoft Common Control vulnerability patched in MS15-060 is interesting but due to it’s limited exposure. The vulnerability requires that the user run the Developer Tools in Internet Explorer. This likely limits the attack to a subset of developers and security researchers that are working with Internet Explorer, the average end-user is unlikely to run Developer Tools for any reason other than an accidental key press. This limited target base could lead to unique uses of this vulnerability.

MS15-061

This month the Windows Kernel-Mode Drivers update is rather large, not quite IE Cumulative Update size but still quite large, and it contains patches for every shipping version of Windows. This update has become a regular addition to Patch Tuesday, so everyone should be prepared for it and ready to apply these updates.

MS15-062

Active Directory Federation Services has seen a number of patches recently and this month we have another one. In this case, it’s a lack of proper sanitization on URLs that could lead to cross-site scripting, allowing the attacker to run scripts as the logged-in user. This security bulletin is interesting, as Microsoft has provided more details than they normally due regarding mitigation, indicating the vulnerable query parameter, the request path, and a simple attack string. While I’m sure that the string is sufficiently broken to avoid exploitation, administrators that cannot apply updates ASAP would be wise to deploy mitigations in their WAF to block requests that follow this format.

MS15-063

This month’s penultimate update resolves a single vulnerability in the Windows Kernel. This attack requires that a malicious DLL be placed on the system and then a special application needs to be run to call LoadLibrary.

MS15-064

The final bulletin resolves three vulnerabilities in Microsoft Exchange 2013. These attacks include a same-origin policy bypass, a CSRF, and HTML Injection, continuing the trend this month where most of the attacks occur in a web-based environment.   As always, VERT recommends that you apply all the patches as soon as possible but also that you fully vet patches (when possible) before applying them to production systems.   Ease-of-Use (published exploits) to Risk Table