Latest Security Advisories & Notable Vulnerabilities

Zero Address Execution in AppleIntelBDWGraphics (CVE-2015-7076)
 Severity:    
 Advisory Date:  11 Dec 2015

Apple has released a security bulletin which covers several vulnerabilities, including CVE-2015-7076, which our security researcher, Juwei Lin discovered and reported to the said company. Apple has credited Lin for his research contribution.

All systems which run on Mac OS X below 10.11.2 (OS X El Capitan) and Intel Graphics Driver AppleIntelBDWGraphics can be affected by this vulnerability. Note, however, that there are certain systems that installed Intel Graphics Driver AppleIntelBDWGraphics by default.

A local privilege escalation vulnerability exists when Intel Graphics Driver handles a special request from usermode. This vulnerability could let the local user be able to execute arbitrary code with system privileges. While Apple rated this vulnerability low since they employ mitigation technologies such as SMAP/SMEP, an attacker with minimal knowledge of IOKit can develop an exploit to abuse this security hole.

In order for the attackers to infect the vulnerable system, users need to execute a program containing an exploit send via spam email. When users execute this malicious program, it gets local system privilege thus enabling the attackers to control the system. This local privilege escalation vulnerability is typically use as part of an entire attack to enable to bypass sandbox and gain system privilege to do further actions thus compromising its (system) security.

Users are advised to update their systems to the latest Mac OS version.

Mediaserver in Android Vulnerability (CVE-2015-6616)
 Severity:    
 Advisory Date:  09 Dec 2015

This vulnerability resides in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01. It allows attackers to execute arbitrary code or cause denial of service (DoS), thus compromising the security of the device.

Trend Micro researcher Peter Pi discovered and reported the details of the vulnerability to Google. The said company credited Pi for his research contribution.

Microsoft addresses the following vulnerabilities in its December batch of patches:

  • (MS15-124) Cumulative Security Update for Internet Explorer (3116180)
    Risk Rating: Critical

    This security update resolves vulnerabilities in Internet Explorer, some of which could allow remote code execution if a user views a specially crafted webpage using Internet Explorer.


  • (MS15-125) Cumulative Security Update for Microsoft Edge (3116184)
    Risk Rating: Critical

    This security update resolves vulnerabilities in Microsoft Edge, some of which could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge.


  • (MS15-126) Cumulative Security Update for JScript and VBScript to Address Remote Code Execution (3116178)
    Risk Rating: Critical

    This security update resolves vulnerabilities found in the VBScript scripting engine in Microsoft Windows. These vulnerabilities could allow remote code execution if a user opens a specially crafted webpage designed to exploit said vulnerabilities.


  • (MS15-127) Security Update for Microsoft Windows DNS to Address Remote Code Execution (3100465)
    Risk Rating: Critical

    This security update resolves vulnerabilities in Microsoft Windows that when exploited successfully, could allow remote code execution. An attacker could exploit the vulnerability by sending a specially crafted request to a DNS server.


  • (MS15-128) Security Update for Microsoft Graphics Component to Address Remote Code Execution (3104503)
    Risk Rating: Critical

    This security update resolves vulnerabilities in Microsoft Windows, .NET Framework, Office, Skype for Business, Lync, and Silverlight. The most severe of the vulnerabilities could allow remote code execution.


  • (MS15-129) Security Update for Silverlight to Address Remote Code Execution (3106614)
    Risk Rating: Critical

    This security update resolves a vulnerability in Microsoft Silverlight. Attackers looking to exploit these vulnerabilities could create a website containing specially crafted Silverlight applications.


  • (MS15-130) Security Update for Microsoft Uniscribe to Address Remote Code Execution (3108670)
    Risk Rating: Critical

    This security update resolves vulnerability in Microsoft Windows that could allow remote code execution.


  • (MS15-131) Security Update for Microsoft Office to Address Remote Code Execution (3116111)
    Risk Rating: Critical

    This security update resolves a vulnerability in Microsoft Office. The vulnerability could allow remote code execution if a user opens a specially crafted Office file that is designed to exploit the vulnerability.


  • (MS15-132) Security Update for Microsoft Windows to Address Remote Code Execution (3116162)
    Risk Rating: Important

    This security update resolves vulnerabilities in Microsoft Windows, some of which could allow remote code execution if an attacker accesses a local system and runs a specially crafted application.


  • (MS15-133) Security Update for Windows PGM to Address Elevation of Privilege (3116130)
    Risk Rating: Important

    This security update resolves a vulnerability in Microsoft Windows that could allow elevation of privilege. Certain conditions in the Microsoft Message Queuing and Windows Pragmatic General Multicast must be present for attackers to successfully exploit this vulnerability.


  • (MS15-134) Security Update for Windows Media Center to Address Remote Code Execution (3108669)
    Risk Rating: Important

    This security update resolves several vulnerabilities in Microsoft Windows, some of which could allow remote code execution when the Windows Media Center opens a specially crafted file with malicious code references.


  • (MS15-135) Security Update for Windows Kernel-Mode Drivers to Address Elevation of Privilege (3119075)
    Risk Rating: Important

    This security update resolves vulnerabilities in Microsoft Windows, some of which could allow elevation of privilege if an attacker logs on to a target system and runs a specially crafted application.


Microsoft addresses the following vulnerabilities in its November batch of patches:

  • (MS15-112) Cumulative Security Update for Internet Explorer (3104517)
    Risk Rating: Critical

    This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user.


  • (MS15-113) Cumulative Security Update for Microsoft Edge (3104519)
    Risk Rating: Critical

    This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user.


  • (MS15-114) Security Update for Windows Journal to Address Remote Code Execution (3100213)
    Risk Rating: Critical

    This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user opens a specially crafted Journal file.


  • (MS15-115) Security Update for Microsoft Windows to Address Remote Code Execution (3105864)
    Risk Rating: Critical

    This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an attacker convinces a user to open a specially crafted document or to visit an untrusted webpage that contains embedded fonts.


  • (MS15-116) Security Update for Microsoft Office to Address Remote Code Execution (3104540)
    Risk Rating: Important

    This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user.


  • (MS15-117) Security Update for NDIS to Address Elevation of Privilege (3101722)
    Risk Rating: Important

    This security update resolves a vulnerability in Microsoft Windows NDIS. The vulnerability could allow elevation of privilege if an attacker logs on to a system and runs a specially crafted application.


  • (MS15-118) Security Update for .NET Framework to Address Elevation of Privilege (3104507)
    Risk Rating: Important

    This security update resolves vulnerabilities in Microsoft .NET Framework. The most severe of the vulnerabilities could allow elevation of privilege if an attacker convinces a user to navigate to a compromised website or open a link in a specially crafted email that is designed to inject client-side code into the user’s browser.


  • (MS15-119) Security Update for Winsock to Address Elevation of Privilege (3104521)
    Risk Rating: Important

    This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker logs on to a target system and runs specially crafted code that is designed to exploit the vulnerability.


  • (MS15-120) Security Update for IPSec to Address Denial of Service (3102939)
    Risk Rating: Important

    This security update resolves a denial of service vulnerability in Microsoft Windows. An attacker who successfully exploited the vulnerability could cause the server to become nonresponsive. To exploit the vulnerability an attacker must have valid credentials.


  • (MS15-121) Security Update for Schannel to Address Spoofing (3081320)
    Risk Rating: Important

    This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow spoofing if an attacker performs a man-in-the-middle (MiTM) attack between a client and a legitimate server.


  • (MS15-122) Security Update for Kerberos to Address Security Feature Bypass (3105256)
    Risk Rating: Important

    This security update resolves a security feature bypass in Microsoft Windows. An attacker could bypass Kerberos authentication on a target machine and decrypt drives protected by BitLocker. The bypass can be exploited only if the target system has BitLocker enabled without a PIN or USB key, the computer is domain-joined, and the attacker has physical access to the computer.


  • (MS15-123) Security Update for Skype for Business and Microsoft Lync to Address Information Disclosure (3105872)
    Risk Rating: Important

    This security update resolves a vulnerability in Skype for Business and Microsoft Lync. The vulnerability could allow information disclosure if an attacker invites a target user to an instant message session and then sends that user a message containing specially crafted JavaScript content.


Adobe Flash Player Vulnerability (CVE-2015-7645)
 Severity:    
 Advisory Date:  14 Oct 2015

This is a zero-day vulnerability in Adobe Flash Player is reportedly used by the Pawn Storm targeted attack campaign. The said vulnerability exists in Adobe Flash Player versions 19.0.0.207 and earlier for Windows and Mac operating systems.

Trend Micro researcher Peter Pi discovered and reported the details of the vulnerability to Adobe. The said company credited Pi for his research contribution.

IOHIDFamily in Apple iOS Vulnerability (CVE-2015-5867)
 Severity:    
 Advisory Date:  13 Oct 2015

This vulnerability exists in Apple iOS before 9 that can allow attackers to execute arbitrary code or cause denial of service (DoS) via a crafted application, thus compromising the security of the device.

Trend Micro researcher Moony Li disclosed details about this vulnerability to Apple. The said company acknowledged Li’s research contribution.

Microsoft addresses the following vulnerabilities in its batch of patches for Octover 2015:

  • (MS15-106) Cumulative Security Update for Internet Explorer (3096441)
    Risk Rating: Critical

    This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer.


  • (MS15-107) Cumulative Security Update for Microsoft Edge (3089665)
    Risk Rating: Important

    This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow information disclosure if a user views a specially crafted webpage using Microsoft Edge.


  • (MS15-108) Security Update for JScript and VBScript to Address Remote Code Execution (3089659)
    Risk Rating: Critical

    This security update resolves vulnerabilities in the VBScript and JScript scripting engines in Microsoft Windows. The more severe of the vulnerabilities could allow remote code execution if an attacker hosts a specially crafted website that is designed to exploit the vulnerabilities through Internet Explorer.


  • (MS15-109)Security Update for Windows Shell to Address Remote Code Execution (3096443)
    Risk Rating: Critical

    This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow remote code execution if a user opens a specially crafted toolbar object in Windows or an attacker convinces a user to view specially crafted content online.


  • (MS15-110) Security Updates for Microsoft Office to Address Remote Code Execution (3096440)
    Risk Rating: Important

    This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file.


  • (MS15-111) Security Update for Windows Kernel to Address Elevation of Privilege (3096447)
    Risk Rating: Important

    This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application.


Android <5.0 Privilege Escalation using ObjectInputStream (CVE-2014-7911)
 Severity:    
 Advisory Date:  08 Oct 2015

This is one of the vulnerabilities used by the exploit kit, GiefRoot, which Retro Tetris, a malicious Android app downloads onto the device. The said malicious gaming app is published on Google Play that has the capability of rooting devices.

An attacker may cause an instance of any class with a non-private parameterless constructor to be created when the ObjectInputStream is used on untrusted inputs. In addition, an attacker may execute arbitrary code via a crafted finalize method for a serialized object in an ArrayMap Parcel within an intent sent to system_service.

Memory Corruption in QSEECOM Driver (CVE-2014-4322)
 Severity:    
 Advisory Date:  02 Oct 2015
drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not validate certain offset, length, and base values within an ioctl call, which allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted application.
Microsoft Internet Explorer is prone to a double free memory corruption vulnerability. Attackers can exploit this issue to execute arbitrary code within the context of the user running the affected application. Failed attempts will likely cause a denial of service condition.