Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2015.2581
Microsoft Security Bulletin MS15-110 Security Updates for Microsoft Office
to Address Remote Code Execution - Important (3096440)
14 October 2015
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Microsoft Office
Microsoft SharePoint Server
Publisher: Microsoft
Operating System: Windows
OS X
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Access Privileged Data -- Remote with User Interaction
Cross-site Scripting -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2015-6039 CVE-2015-6037 CVE-2015-2558
CVE-2015-2557 CVE-2015-2556 CVE-2015-2555
Original Bulletin:
https://technet.microsoft.com/en-us/library/security/MS15-110
- --------------------------BEGIN INCLUDED TEXT--------------------
Microsoft Security Bulletin MS15-110 Security Updates for Microsoft Office to
Address Remote Code Execution - Important (3096440)
Document Metadata
Bulletin Number: MS15-110
Bulletin Title: Security Updates for Microsoft Office to Address Remote Code
Execution
Severity: Important
KB Article: 3096440
Version: 1.0
Published Date: October 13, 2015
Executive Summary
This security update resolves vulnerabilities in Microsoft Office. The most
severe of the vulnerabilities could allow remote code execution if a user
opens a specially crafted Microsoft Office file. An attacker who successfully
exploited the vulnerabilities could run arbitrary code in the context of the
current user. Customers whose accounts are configured to have fewer user
rights on the system could be less impacted than those who operate with
administrative user rights.
Affected Software
Microsoft Excel 2007 Service Pack 3
Microsoft Visio 2007 Service Pack 3
Microsoft Excel 2010 Service Pack 2 (32-bit editions)
Microsoft Excel 2010 Service Pack 2 (64-bit editions)
Microsoft Visio 2010 Service Pack 2 (32-bit editions)
Microsoft Visio 2010 Service Pack 2 (64-bit editions)
Microsoft Excel 2013 Service Pack 1 (32-bit editions)
Microsoft Excel 2013 Service Pack 1 (64-bit editions)
Microsoft Excel 2013 RT Service Pack 1 [1]
Microsoft Excel 2016 (32-bit edition)
Microsoft Excel 2016 (64-bit edition)
Microsoft Excel for Mac 2011
Microsoft Excel 2016 for Mac
Microsoft Excel Viewer
Microsoft Office Compatibility Pack Service Pack 3
Excel Services on Microsoft SharePoint Server 2007 Service Pack 3 (32-bit
editions)
Excel Services on Microsoft SharePoint Server 2007 Service Pack 3 (64-bit
editions)
Excel Services on Microsoft SharePoint Server 2010 Service Pack 2
Excel Services on Microsoft SharePoint Server 2013 Service Pack 1
Microsoft Office Web Apps 2010 Service Pack 2
Microsoft Excel Web App 2010 Service Pack 2
Microsoft Office Web Apps Server 2013 Service Pack 1
Microsoft SharePoint Server 2007 Service Pack 3 (32-bit editions)
Microsoft SharePoint Server 2007 Service Pack 3 (64-bit editions)
Microsoft SharePoint Server 2010 Service Pack 2
Microsoft SharePoint Server 2013 Service Pack 1
Microsoft SharePoint Foundation 2013 Service Pack 1
[1]This update is available via Windows Update.
Vulnerability Information
Multiple Microsoft Office Memory Corruption Vulnerabilities
Remote code execution vulnerabilities exist in Microsoft Office software when
the Office software fails to properly handle objects in memory. An attacker
who successfully exploited these vulnerabilities could run arbitrary code in
the context of the current user. If the current user is logged on with
administrative user rights, an attacker could take control of the affected
system. An attacker could then install programs; view, change, or delete data;
or create new accounts with full user rights. Users whose accounts are
configured to have fewer user rights on the system could be less impacted than
users who operate with administrative user rights.
Exploitation of these vulnerabilities requires that a user open a specially
crafted file with an affected version of Microsoft Office software. In an
email attack scenario an attacker could exploit the vulnerabilities by sending
the specially crafted file to the user and convincing the user to open the
file. In a web-based attack scenario an attacker could host a website (or
leverage a compromised website that accepts or hosts user-provided content)
that contains a specially crafted file that is designed to exploit the
vulnerabilities. An attacker would have no way to force users to visit the
website. Instead, an attacker would have to convince users to click a link,
typically by way of an enticement in an email or Instant Messenger message,
and then convince them to open the specially crafted file.
The security update addresses the vulnerabilities by correcting how Office
handles objects in memory.
The following tables contain links to the standard entry for each
vulnerability in the Common Vulnerabilities and Exposures list:
Vulnerability title CVE number Publicly disclosed Exploited
Microsoft Office Memory Corruption Vulnerability CVE-2015-2555 No No
Microsoft Office Memory Corruption Vulnerability CVE-2015-2557 No No
Microsoft Office Memory Corruption Vulnerability CVE-2015-2558 No No
Microsoft SharePoint Information Disclosure Vulnerability CVE-2015-2556
An information disclosure vulnerability exists when SharePoint InfoPath Forms
Services improperly parses the Document Type Definition (DTD) of an XML file.
An attacker who successfully exploited the vulnerability could browse the
contents of arbitrary files on a SharePoint server. An attacker must have
write permissions to a site and InfoPath Services must be enabled to exploit
the vulnerability.
An attacker could exploit the vulnerability by uploading a specially crafted
file to a web page and then sending a specially crafted web request to the
SharePoint server. The security update addresses the vulnerability by ensuring
that SharePoint InfoPath Forms Services properly handles DTD entities.
Microsoft received information about the vulnerability through coordinated
vulnerability disclosure. At the time this security bulletin was originally
issued, Microsoft was unaware of any attack attempting to exploit this
vulnerability.
Microsoft Office Web Apps XSS Spoofing Vulnerability - CVE-2015-6037
A spoofing vulnerability exists when an Office Web Apps Server does not
properly sanitize a specially crafted request. An authenticated attacker could
exploit the vulnerability by sending a specially crafted request to an
affected Office Web Apps Server. The attacker who successfully exploited this
vulnerability could then perform cross-site scripting attacks on affected
systems and run script in the security context of the current user. These
attacks could allow the attacker to read content that the attacker is not
authorized to read, use the victim's identity to take actions on the Office
Web App site on behalf of the victim, such as change permissions, delete
content, steal sensitive information (such as browser cookies) and inject
malicious content in the browser of the victim.
For this vulnerability to be exploited, a user must click a specially crafted
URL that takes the user to a targeted Office Web App site. In an email attack
scenario, an attacker could exploit the vulnerability by sending an email
message containing the specially crafted URL to the user of the targeted
Office Web App site and convincing the user to click the specially crafted
URL. In a web-based attack scenario, an attacker would have to host a website
that contains a specially crafted URL to the targeted Office Web App site that
is used to attempt to exploit this vulnerability. In addition, compromised
websites and websites that accept or host user-provided content could contain
specially crafted content that could exploit the vulnerability. An attacker
would have no way to force users to visit a specially crafted website.
Instead, an attacker would have to convince them to visit the website,
typically by getting them to click a link in an instant messenger or email
message that takes them to the attacker's website, and then convince them to
click the specially crafted URL.
The security update addresses the vulnerability by helping to ensure that
Office Web Apps Server properly sanitizes web requests. Microsoft received
information about the vulnerability through coordinated vulnerability
disclosure. At the time this security bulletin was originally issued,
Microsoft was unaware of any attack attempting to exploit this vulnerability.
Microsoft SharePoint Security Feature Bypass Vulnerability CVE-2015-6039
A security feature bypass vulnerability exists in Microsoft SharePoint. The
vulnerability is caused when Office Marketplace is allowed to inject
JavaScript code that persists onto a SharePoint page, because SharePoint does
not enforce the appropriate permission level for an application or user. An
attacker who successfully exploited this vulnerability could perform
persistent cross-site scripting attacks and run script (in the security
context of the logged-on user) with malicious content that appears authentic.
This could allow the attacker to steal sensitive information, including
authentication cookies and recently submitted data.
To exploit this vulnerability, an attacker must have the ability to update the
Marketplace instance. The attacker could add malicious code to the Marketplace
app that could then be pushed to the consuming SharePoint instances. The
malicious script would enable the attacker to update code without having to go
through the SharePoint farm/instance-level permissions.
The security update addresses the vulnerability by modifying the SharePoint
farm/instance code to enforce the appropriate permission level for an
application or user. This vulnerability has been publicly disclosed. It has
been assigned Common Vulnerability and Exposure number CVE-2015-6039. At the
time this security bulletin was originally issued, Microsoft was unaware of
any attack attempting to exploit this vulnerability.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVh2feH6ZAP0PgtI9AQLAPw//cDcbOZ1u5vPObBGQ4M/qDofgVFkfHnAN
zdFnmXmy54VjIjaONNg/hWp6X85nteJZaLcpVSE+9qd3n+zenUu4pFvXTC+VOEje
WUIWNwKoLqEVnGT2uVYpny2X4UEsVfduEUw0HK6AVzGQnFari8v6s5cSDlXLsM5m
9PcS3O8GvSuz9acNGD13tH7W6WK0lzjTXPGIpIbqct9mjBgPFaYF0SVDvsbg5zIj
j5Oje1U+YF3lbgi2OGhopkseTSbvMJKNOUkGb2XJ2cm/fGHxj+qoH3Z3sgyNt3P5
Jb2wf/LxACfFp1VwwQNmdqoemu22GHruvgf+oqLwbdTREEHDjxIq7S2ZwJ05erRi
smZc/gDI1xDJKB6myTlE+IgPXvFERyv8LBkQuxXVP+EHIG/JV8uGN+6/z4LUh+dM
DbGYnE3KXJig6somW3eWqAt6qnkSS5GdfTnc5gayV+asCZJ1x01ACfFEFfehcvwS
Qcs7NhdrRHWDpjH2poGCYjlk4k51IIHUgJJ76RI5eXBhXAAofMBKkA6TFX4iJ5G0
63bvOPKHeDY8P571JlfyfRizDxqKYXULOLxsJz6aXw7dRW7E3Y8l5wXYkQyogD8u
Qbs+aLzEuM9HM7ZdA2r1abjQbvt4cyW7C8t74hK1+5Dn9IdXNX50AeWXyw17lJIF
s9U+dZYBHmQ=
=mFmM
-----END PGP SIGNATURE-----