-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2016.0330
     MS16-011 Cumulative Security Update for Microsoft Edge (3134225)
                             10 February 2016

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Microsoft Edge
Publisher:         Microsoft
Operating System:  Windows 10
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Provide Misleading Information  -- Remote with User Interaction
                   Reduced Security                -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2016-0084 CVE-2016-0080 CVE-2016-0077
                   CVE-2016-0062 CVE-2016-0061 CVE-2016-0060

Original Bulletin: 
   https://technet.microsoft.com/en-us/library/security/MS16-011

- --------------------------BEGIN INCLUDED TEXT--------------------

MS16-011 Cumulative Security Update for Microsoft Edge (3134225)

Bulletin Number: MS16-011

Bulletin Title: Cumulative Security Update for Microsoft Edge

Severity: Critical

KB Article: 3134225

Version: 1.0

Published Date: February 9, 2016

Executive Summary

This security update resolves vulnerabilities in Microsoft Edge. The most 
severe of the vulnerabilities could allow remote code execution if a user 
views a specially crafted webpage using Microsoft Edge. An attacker who 
successfully exploited the vulnerabilities could gain the same user rights as
the current user. Customers whose accounts are configured to have fewer user 
rights on the system could be less impacted than those who operate with 
administrative user rights.

This security update is rated Critical for Microsoft Edge on Windows 10.

Affected Software

Windows 10 for 32-bit Systems[1]

Windows 10 for x64-based Systems[1]

Windows 10 Version 1511 for 32-bit Systems[1]

Windows 10 Version 1511 for x64-based Systems [1]

[1]Windows 10 updates are cumulative. In addition to containing non-security 
updates, they also contain all of the security fixes for all of the Windows 
10-affected vulnerabilities shipping with the monthly security release. The 
updates are available via the Microsoft Update Catalog.

Vulnerability Information

Microsoft Browser Spoofing Vulnerability - CVE-2016-0077

A spoofing vulnerability exists when a Microsoft browser does not properly 
parse HTTP responses. An attacker who successfully exploited this 
vulnerability could trick a user by redirecting them to a specially crafted 
website. The specially crafted website could spoof content or be used as a 
pivot to chain an attack with other vulnerabilities in web services.

To exploit the vulnerability, the user must click a specially crafted URL. In
an email attack scenario, an attacker could send an email message containing 
the specially crafted URL to the user in an attempt to convince the user to 
click it.

In a web-based attack scenario, an attacker could host a specially crafted 
website designed to appear as a legitimate website to the user. However, the 
attacker would have no way to force the user to visit the specially crafted 
website. The attacker would have to convince the user to visit the specially 
crafted website, typically by way of enticement in an email or Instant 
Messenger message, and then convince the user to interact with content on the
website. The update addresses the vulnerability by correcting how Microsoft 
Edge parses HTTP responses.

The following table contains links to the standard entry for each 
vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability title 				CVE number 	Publicly disclosed 	Exploited

Microsoft Browser Spoofing Vulnerability 	CVE-2016-0077	No 			No

Microsoft Edge ASLR Bypass Vulnerability - CVE-2016-0080

A security feature bypass vulnerability for Microsoft Edge exists as a result
of how exceptions are handled when dispatching certain window messages, 
allowing an attacker to probe the layout of the address space and thereby 
bypassing Address Space Layout Randomization (ASLR). By itself, the ASLR 
bypass vulnerability does not allow arbitrary code execution. However, an 
attacker could use the ASLR bypass vulnerability in conjunction with another 
vulnerability, such as a remote code execution vulnerability, to run arbitrary
code on a target system.

Successful exploitation of the ASLR bypass vulnerability requires a user to be
logged on and running an affected version of Microsoft Edge. The user would 
then need to browse to a malicious site. The update addresses the ASLR bypass
vulnerability by helping to ensure that Microsoft Edge properly handles 
exceptions when dispatching certain window messages.

The following table contains links to the standard entry for each 
vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability title 		CVE number 	Publicly disclosed 	Exploited

Microsoft Edge ASLR Bypass 	CVE-2016-0080	No 			No

Multiple Microsoft Edge Memory Corruption Vulnerabilities

Multiple remote code execution vulnerabilities exist when Microsoft Edge 
improperly accesses objects in memory. The vulnerabilities could corrupt 
memory in such a way that an attacker could execute arbitrary code in the 
context of the current user.

An attacker could host a specially crafted website that is designed to exploit
the vulnerabilities through Microsoft Edge, and then convince a user to view 
the website. The attacker could also take advantage of compromised websites 
and websites that accept or host user-provided content or advertisements by 
adding specially crafted content that could exploit the vulnerability. In all
cases, however, an attacker would have no way to force users to view the 
attacker-controlled content. Instead, an attacker would have to convince users
to take action, typically by way of enticement in an email or Instant 
Messenger message, or by getting them to open an attachment sent through 
email.

An attacker who successfully exploited the vulnerabilities could gain the same
user rights as the current user. If the current user is logged on with 
administrative user rights, an attacker who successfully exploited the 
vulnerabilities could take control of an affected system. An attacker could 
then install programs; view, change, or delete data; or create new accounts 
with full user rights. The update addresses the vulnerability by modifying how
Microsoft Edge handles objects in memory.

The following table contains links to the standard entry for each 
vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability title 					CVE number 	Publicly disclosed 	Exploited

Microsoft Browser Memory Corruption Vulnerability 	CVE-2016-0060	No 			No

Microsoft Browser Memory Corruption Vulnerability 	CVE-2016-0061	No 			No

Microsoft Browser Memory Corruption Vulnerability	CVE-2016-0062	No 			No

Microsoft Edge Memory Corruption Vulnerability 		CVE-2016-0084	No 			No

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVrqX9H6ZAP0PgtI9AQLJkg//WDGTNYAcailoeVa1lzrNinVIGfYiNv/p
ZbY9kff9278I2n3JSf8Witw8gxQc1oimp/JIybjXioD1eZARMTN8/YE+k6Y77hHZ
WdCbqASY8rh/kb5mIbh5zxzmATy9YvHLhpwDReRmAySZJqNw/OQZKtfA46wtrh1P
7P/KQwqeEZmQ90xaa0yssRGkjzFlKc5a6ojtopCMuKAOKOIZ16GHtaGGaLfqv6Fm
dYr2Lt4zJW1qz65kY3z4p9zDHcHjscKM5GInVbl5f5erejOhonleBrHtUyRCROML
/0U4MRZ7he9Y/u94du4jZQKNW5JvdVEfzHxqcMsLm/OIr1oultal7O/U92fMhKIx
AkonCTia3sZ7ewUVFBzdVhDUzVtoL/BEdDWLJZ20/iOFO3kWuVpIA4iqZYbVwxWl
x3GhwDBPdV86vtRCEVDaRsfhn819ROVxBVB/q5gMDAID/2ot6D7RBIxEVcWRlssQ
OIr7aHd4jWxHwwSCBIHbVJuNEpi6/ZM7IQsi9mNnSCipt7YJC/GCo9rRrYa/iLR8
RRT2z1Gfy6YdvKqw0WFkR8xsS1mMSyT5CW2w8gDplfE64ZSQ3pRsE9ZucqXIAdYl
CX5d+xe72JS0FWjhk5x2yw6mZV1ifcZfRqrHdIa0xrLe5RSDdOhLX/oqYeqc/pkH
rTK3Bt86I8E=
=M5of
-----END PGP SIGNATURE-----