Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2015.0329
MS15-016: Vulnerability in Microsoft Graphics Component
Could Allow Information Disclosure
11 February 2015
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Microsoft Windows
Publisher: Microsoft
Operating System: Windows
Impact/Access: Access Confidential Data -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2015-0061
Original Bulletin:
https://technet.microsoft.com/en-us/library/security/MS15-016
- --------------------------BEGIN INCLUDED TEXT--------------------
Bulletin Number: MS15-016
Bulletin Title: Vulnerability in Microsoft Graphics Component Could Allow
Information Disclosure
Severity: Important
KB Article: 3029944
Version: 1.0
Published Date: February 10, 2015
Description: This security update resolves a privately reported vulnerability
in Microsoft Windows. The vulnerability could allow information disclosure if
a user browses to a website containing a specially crafted TIFF image. This
vulnerability would not allow an attacker to execute code or to elevate their
user rights directly, but it could be used to obtain information that could be
used to try to further compromise the affected system.
Executive Summary
This security update resolves a privately reported vulnerability in Microsoft
Windows. The vulnerability could allow information disclosure if a user
browses to a website containing a specially crafted TIFF image. This
vulnerability would not allow an attacker to execute code or to elevate their
user rights directly, but it could be used to obtain information that could be
used to try to further compromise the affected system.
This security update is rated Important for all supported releases of
Microsoft Windows. For more information, see the Affected Software section.
Affected Software
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
Windows 8 for 32-bit Systems
Windows 8 for x64-based Systems
Windows 8.1 for 32-bit Systems
Windows 8.1 for x64-based Systems
Windows Server 2012
Windows Server 2012 R2
Windows RT[1]
Windows RT 8.1[1]
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core
installation)
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core
installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core
installation)
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2 (Server Core installation)
[1]This update is available via Windows Update only.
Vulnerability Information
TIFF Processing Information Disclosure Vulnerability - CVE-2015-0061
An information disclosure vulnerability exists when Windows fails to properly
handle uninitialized memory when parsing certain, specially crafted TIFF image
format files. The vulnerability could allow information disclosure if an
attacker runs a specially crafted application on an affected system.
An attacker could host a specially crafted website that is designed to exploit
this vulnerability and then convince a user to view the website. This could
also include compromised websites and websites that accept or host
user-provided content or advertisements. These websites could contain
specially crafted content that could exploit this vulnerability. In all cases,
however, an attacker would have no way to force users to visit these websites.
Instead, an attacker would have to convince users to visit the website,
typically by getting them to click a link in an instant messenger or email
message that takes users to the attacker's website. It could also be possible
to display specially crafted web content by using banner advertisements or by
using other methods to deliver web content to affected systems.
An attacker who successfully exploited this vulnerability could potentially
read data which was not intended to be disclosed. Note that this vulnerability
would not allow an attacker to execute code or to elevate their user rights
directly, but it could be used to obtain information that could be used to try
to further compromise the affected system. The update addresses the
vulnerability by correcting how Windows processes TIFF image format files.
Microsoft received information about this vulnerability through coordinated
vulnerability disclosure. When this security bulletin was originally issued
Microsoft had not received any information to indicate that this vulnerability
had been publicly used to attack customers.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVNqcehLndAQH1ShLAQJgDA//dKpJC4UT2Anbh1pPTA2CxhfCAdRQC0La
tY6lDsU167NpaT/HBYoq3Fvu8YWLcSaE91d7kI1hGv7wtmOpxGtUommC2LC0aDwG
ZN2klieLqxWdDLRm7eZLQ1YKPcc9Em2gecMkCrQ5vqiG1GjSLPtBKzA3MhKVslvp
/r0WnZZyhfPOEUkEtr+216tqdCJdNCaUDpanofitz90ay+XiYkq6w44GQ8IZ0asB
qBN1tmZVbBTzH9vMk2aDCTpp52ygYIzF0wFV2hzwvd+zBHunXqJ6ccVSppWaYM7r
e5CAdZ7lo+qBDtvKP2LNNHY5gPIEnNfgVPX0wdTMEzGKzVDV3z7is8SSnb0/Wsuw
7AW8Ij+2tLGjSQ0Y3eFAm0JoIyByTnAUuPEfkcxRxfO0dK46TFdnPHul8+4byytm
jRMRGIUCybqVpwJBkOZNRHApenOH64QywQaoGsBmpGrUKf/1V1LlZLBxBLImaaQJ
E2zl8puxOikd4h9Vw1o49Y2S1lrg9qz0WioaIq+AJsLFQNRjX/TcUfReeYjcRIWK
+dWalFKTKrO6Iy1T6Sb9J95xNjECcSZc3IhVuR2Xj2/aQzqO0EXiMdEzVfc8v0J8
kJGwfmKnFLfCIErOd9NJkZ7IizUb92dWzn5jZzjrOodKLIToNHi0kCS4ExjfQrop
SNb+RpQWKBA=
=97Dc
-----END PGP SIGNATURE-----