Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2016.0925
Microsoft Security Bulletin MS16-045: Security Update for
Windows Hyper-V (3143118)
13 April 2016
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Microsoft Windows with Hyper-V
Publisher: Microsoft
Operating System: Windows
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Access Privileged Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2016-0090 CVE-2016-0089 CVE-2016-0088
Original Bulletin:
https://technet.microsoft.com/en-us/library/security/MS16-045
- --------------------------BEGIN INCLUDED TEXT--------------------
Microsoft Security Bulletin MS16-045: Security Update for Windows Hyper-V
(3143118)
Bulletin Number: MS16-045
Bulletin Title: Security Update for Windows Hyper-V
Severity: Important
KB Article: 3143118
Version: 1.0
Published Date: April 12, 2016
Executive Summary
This security update resolves vulnerabilities in Microsoft Windows. The
most severe of the vulnerabilities could allow remote code execution if an
authenticated attacker on a guest operating system runs a specially crafted
application that causes the Hyper-V host operating system to execute arbitrary
code. Customers who have not enabled the Hyper-V role are not affected.
This security update is rated Important for all supported editions of Windows
8.1 for x64-based Systems, Windows Server 2012, Windows Server 2012 R2,
and Windows 10 for x64-based Systems.
Affected Software
Windows 8.1 for x64-based Systems (3135456)
Windows Server 2012 and Windows Server 2012 R2
Windows 10 for x64-based Systems[1](3147461)
Windows Server 2012 (Server Core installation)(3135456)
Windows Server 2012 R2 (Server Core installation)(3135456)
[1]Windows 10 updates are cumulative. The monthly security release includes
all security fixes for vulnerabilities that affect Windows 10, in addition
to non-security updates. The updates are available via the Microsoft Update
Catalog.
Vulnerability Information
Hyper-V Remote Code Execution Vulnerability - CVE-2016-0088
A remote code execution vulnerability exists when Windows Hyper-V on a
host server fails to properly validate input from an authenticated user on
a guest operating system. To exploit the vulnerability, an attacker could
run a specially crafted application on a guest operating system that could
cause the Hyper-V host operating system to execute arbitrary code. Customers
who have not enabled the Hyper-V role are not affected.
An attacker who successfully exploited the vulnerability could execute
arbitrary code on the host operating system. The security update addresses
the vulnerability by correcting how Hyper-V validates guest operating system
user input.
The following table contains links to the standard entry for each vulnerability
in the Common Vulnerabilities and Exposures list:
Vulnerability title CVE number Publicly disclosed Exploited
Hyper-V Remote Code Execution Vulnerability CVE-2016-0088 No No
Multiple Hyper-V Information Disclosure Vulnerabilities
Information disclosure vulnerabilities exist when Windows Hyper-V on a host
operating system fails to properly validate input from an authenticated user
on a guest operating system. To exploit the vulnerabilities, an attacker
on a guest operating system could run a specially crafted application
that could cause the Hyper-V host operating system to disclose memory
information. Customers who have not enabled the Hyper-V role are not affected.
An attacker who successfully exploited the vulnerabilities could gain access
to information on the Hyper-V host operating system. The security update
addresses the vulnerabilities by correcting how Hyper-V validates guest
operating system user input.
The following table contains links to the standard entry for each vulnerability
in the Common Vulnerabilities and Exposures list:
Vulnerability title CVE number Publicly disclosed Exploited
Hyper-V Information Disclosure Vulnerability CVE-2016-0089 No No
Hyper-V Information Disclosure Vulnerability CVE-2016-0090 No No
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVw1xtX6ZAP0PgtI9AQIu3xAAv7ubGV0+Wgg7OauPZ3IXilClKlaKQ2o+
ACeXciWvNrG23FVSDhiYqXiaMuTOHCO5B/zszz6lJJtQcB+J/X9ZKuAOe80soRpH
FK3ceD+u9I/HDLAobstR0zYzQhsCZtbiFVrgt7gLk5nlzS9/q151/vpx0B4WbKAF
pBG18AnXRMp9DfV/hEoQax4dMz8nIfXUIJ8pOs0uICe443yfLW8M+c5NeYuVmaR9
i4HHYu19Vv134zur3t2s0jsqZFf3qpeCgjO4ax60XM0ue08TrfRwj2VAvfOfh2Ka
RwPhzvr3pswLL22FMeFAJoVxHE8IMvZ7XA6K/vvVbuCP4Lj3jJbRPhPe1ZzjOJ7k
SyP+yLEstjpw46yDwG7GH1wECspZ3EWEaxXuEWuMn5P5w3TPzxjnGqFmaSWkSk3K
QNSnP6Szv5PGBVe80E5QEMincttQ84IHSyAqOd1vwGKfxWRuZOofHlXCw6+NQmdy
lzd0hWZDzSCN10E5FVAIU33S0jVhvlzBBWBlpCfjxX8fKBuesQSR8ICr1QbHl8HB
0lobZ2g0G4WgRdNsDdmMaYYPY91aZIv7Aw21PpxWHBmI6zmOw5UIN/7VF+w4LEzd
cVZiQg1X+7Avnp4U6+dH0fkv+YwH+/ZxVNItcyWJmImkPk75FyUawP/AjKy0Sy0P
MXuL3d7JaCc=
=QJJe
-----END PGP SIGNATURE-----