Advisory Date: 12 May 2015

  DESCRIPTION

Microsoft addresses the following vulnerabilities in its May batch of patches for 2015:

  • (MS15-043) Cumulative Security Update for Internet Explorer (3049563)
    Risk Rating: Critical

    This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer.


  • (MS15-044) Vulnerabilities in Microsoft Font Drivers Could Allow Remote Code Execution (3057110)
    Risk Rating: Critical

    This security update resolves vulnerabilities in Microsoft Windows, Microsoft .NET Framework, Microsoft Office, Microsoft Lync, and Microsoft Silverlight. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted document or visits an untrusted webpage that contains embedded TrueType fonts.


  • (MS15-045) Vulnerability in Windows Journal Could Allow Remote Code Execution (3046002)
    Risk Rating: Critical

    This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow remote code execution if a user opens a specially crafted Journal file. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.


  • (MS15-046) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3057181)
    Risk Rating: Important

    This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file.


  • (MS15-047) Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution (3058083)
    Risk Rating: Important

    This security update resolves vulnerabilities in Microsoft Office server software. The vulnerabilities could allow remote code execution if an authenticated attacker sends specially crafted page content to a SharePoint server.


  • (MS15-048) Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (3057134)
    Risk Rating: Important

    This security update resolves vulnerabilities in Microsoft .NET Framework. The most severe of the vulnerabilities could allow elevation of privilege if a user installs a specially crafted partial trust application.


  • (MS15-049) Vulnerability in Silverlight Could Allow Elevation of Privilege (3058985)
    Risk Rating: Important

    This security update resolves a vulnerability in Microsoft Silverlight. The vulnerability could allow elevation of privilege if a specially crafted Silverlight application is run on an affected system. To exploit the vulnerability an attacker would first have to log on to the system or convince a logged on user to execute the specially crafted application.


  • (MS15-050) Vulnerability in Service Control Manager Could Allow Elevation of Privilege (3055642)
    Risk Rating: Important

    This security update resolves a vulnerability in Windows Service Control Manager (SCM), which is caused when SCM improperly verifies impersonation levels. The vulnerability could allow elevation of privilege if an attacker first logs on to the system and then runs a specially crafted application designed to increase privileges.


  • (MS15-051) Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (3057191)
    Risk Rating: Important

    This security update resolves vulnerabilities in Microsoft Windows. The more severe of these vulnerabilities could allow elevation of privilege if an attacker logs on locally and runs arbitrary code in kernel mode.


  • (MS15-052) Vulnerability in Windows Kernel Could Allow Security Feature Bypass (3050514)
    Risk Rating: Important

    This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow security feature bypass if an attacker logs on to an affected system and runs a specially crafted application.


  • (MS15-053) Vulnerabilities in JScript and VBScript Scripting Engines Could Allow Security Feature Bypass (3057263)
    Risk Rating: Important

    This security update resolves ASLR security feature bypasses in the JScript and VBScript scripting engines in Microsoft Windows. An attacker could use one of these ASLR bypasses in conjunction with another vulnerability, such as a remote code execution vulnerability, to more reliably run arbitrary code on a target system.


  • (MS15-054) Vulnerability in Microsoft Management Console File Format Could Allow Denial of Service (3051768)
    Risk Rating: Important

    This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow denial of service if a remote, unauthenticated attacker convinces a user to open a share containing a specially crafted .msc file. However, an attacker would have no way of forcing a user to visit the share or view the file.


  • (MS15-055) Vulnerability in Schannel Could Allow Information Disclosure (3061518)
    Risk Rating: Important

    This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow information disclosure when Secure Channel (Schannel) allows the use of a weak Diffie-Hellman ephemeral (DFE) key length of 512 bits in an encrypted TLS session. Allowing 512-bit DHE keys makes DHE key exchanges weak and vulnerable to various attacks. A server needs to support 512-bit DHE key lengths for an attack to be successful; the minimum allowable DHE key length in default configurations of Windows servers is 1024 bits.


  INFORMATION EXPOSURE

Trend Micro Deep Security shields networks through the following Deep Packet Inspection (DPI) rules. Trend Micro customers using the Vulnerability Protection product or OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities.

MS Bulletin ID Vulnerability ID DPI Rule Number DPI Rule Name Release Date Vulnerability Protection and IDF Compatibility
MS15-043 CVE-2015-1658 1006662 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1658) 12-May-15 YES
MS15-045 CVE-2015-1675 1006663 Microsoft Windows Journal Remote Code Execution Vulnerability (CVE-2015-1675) 12-May-15/td> YES
MS15-043 CVE-2015-1685 1006664 1006664 Microsoft Internet Explorer ASLR Bypass (CVE-2015-1685) 12-May-15 YES
MS15-043 CVE-2015-1686 1006665 Microsoft Internet Explorer VBScript ASLR Bypass (CVE-2015-1686) 12-May-15 YES
MS15-053 CVE-2015-1686 1006665 Microsoft Internet Explorer VBScript ASLR Bypass (CVE-2015-1686) 12-May-15 YES
MS15-043 CVE-2015-1689 1006666 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1689) 12-May-15 YES
MS15-043 CVE-2015-1691 1006667 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1691) 12-May-15 YES
MS15-043 CVE-2015-1692 1006668 Microsoft Internet Explorer Clipboard Information Disclosure Vulnerability (CVE-2015-1692) 12-May-15 YES
MS15-045 CVE-2015-1695 1006669 Microsoft Windows Journal Remote Code Execution Vulnerability (CVE-2015-1695) 12-May-15 YES
MS15-045 CVE-2015-1696 1006670 Microsoft Windows Journal Remote Code Execution Vulnerability (CVE-2015-1696) 12-May-15 YES
MS15-045 CVE-2015-1697 1006671 Microsoft Windows Journal Remote Code Execution Vulnerability (CVE-2015-1697) 12-May-15 YES
MS15-045 CVE-2015-1698 1006672 Microsoft Windows Journal Remote Code Execution Vulnerability (CVE-2015-1698) 12-May-15 YES
MS15-045 CVE-2015-1699 1006673 Microsoft Windows Journal Remote Code Execution Vulnerability (CVE-2015-1699) 12-May-15 YES
MS15-043 CVE-2015-1705 1006674 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1705) 12-May-15 YES
MS15-043 CVE-2015-1706 1006675 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1706) 12-May-15 YES
MS15-043 CVE-2015-1708 1006676 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1708) 12-May-15 YES
MS15-043 CVE-2015-1710 1006678 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1710) 12-May-15 YES
MS15-043 CVE-2015-1711 1006679 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1711) 12-May-15 YES
MS15-043 CVE-2015-1712 1006680 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1712) 12-May-15 YES
MS15-043 CVE-2015-1717 1006694 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1717) 12-May-15 YES
MS15-043 CVE-2015-1718 1006695 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1718) 12-May-15 YES
MS15-046 CVE-2015-1682 1006696 Microsoft Office Memory Corruption Vulnerability (CVE-2015-1682) 12-May-15 YES
MS15-043 CVE-2015-1714 1006697 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1714) 12-May-15 YES
MS15-043 CVE-2015-1709 1006698 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1709) 12-May-15 YES

  SOLUTION