Home Tags Microsoft Security

Tag: Microsoft Security

Microsoft patches most NSA Windows exploits, but vulnerabilities remain

Microsoft on Friday said it had patched most of the Windows vulnerabilities purportedly exploited by the National Security Agency (NSA) using tools that were leaked last week.The Windows flaws were disclosed by the hacking gang Shadow Brokers in a l...

VU#921560: Microsoft OLE URL Moniker improperly handles remotely-linked HTA data

Microsoft OLE uses the URL Moniker to open application data based on the server-provided MIME type,which can allow an unauthenticated remote attacker to execute arbitrary code on a vulnerable system.

Microsoft Friday false positive: Bluber-A ballsup makes sysadmins blub

Benign and fine but alarms do double-time Enterprises were faced with all sorts of inconvenience on Friday after a Microsoft security tool incorrectly flagged up benign files as infected with a worm.…

Security fixes delayed as Microsoft postpones Patch Tuesday

A surprise announcement yesterday afternoon rattled Microsoft customers: Patch Tuesday is officially being delayed for a month.Microsoft is being close-mouthed.

A curt, unsigned post on the Microsoft Security Resource Center TechNet blog simply states: "UPDATE: 2/15/17: We will deliver updates as part of the planned March Update Tuesday, March 14, 2017."[ InfoWorld's deep look: Why (and how) you should manage Windows 10 PCs like iPhones. | The essentials for Windows 10 installation: Download the Windows 10 Installation Superguide today. ]Microsoft started documenting its security patches with Security Bulletins in 1998, but the patches arrived at random.
Steve Ballmer announced the Patch Tuesday protocol on Oct. 9, 2003 to “reduce the burden on IT administrators by adding a level of increased predictability and manageability.” Starting with MS03-041, security patches were generally held until the second -- sometimes third or fourth -- Tuesday of the month.To read this article in full or to leave a comment, please click here

VU#867968: Microsoft Windows SMB Tree Connect Response denial of service vulnerability

Microsoft Windows contains a memory corruption bug in the handling of SMB traffic,which may allow a remote,unauthenticated attacker to cause a denial of service on a vulnerable system.

Chrome dev explains how modern browsers make secure UI just about...

The 'LINE OF DEATH' between safe content and untrustworthy stuff is receding every year Google Chrome engineer Eric Lawrence has described the battle of browser barons against the 'line of death', an ever-diminishing demarcation between trusted content and the no-man's land where phishers dangle their poison. The line, Lawrence (@ericlaw) says, is a conceptual barrier between content that browser developers control, such as areas around the address bar, and untrusted content like browser windows where attackers can serve malicious material. "If a user trusts pixels above the line of death, the thinking goes, they’ll be safe, but if they can be convinced to trust the pixels below the line, they’re gonna die," Lawrence says. But the line is receding because untrusted content now appears above the line in tabs where attackers can enter their chosen web page title and icon. Chevrons that open small windows can display extended information on usage of HTTPS, requests for location information, and so on extend below the line and send trusted data into untrusted territory. Chevrons with trusted data breach the line.
Image: Lawrence. Those subtle intrusions across the line open avenues for phishers; chevron popups can be faked and 'block' and 'allow' buttons turned into malicious clickable links, for example. In 2005, a remote code execution flaw affecting Firefox was dug up which abused favicons, the untrusted icons websites set that appear in tabs and bookmarks. The line of death deteriorated in 2012 when Microsoft moved Windows 8 Internet Explorer to its full screen minimalistic immersive mode. Lawrence, then program lead for Internet Explorer with Microsoft, opposed the move and says it made the line of death indistinguishable from content, . "... because it (Internet Explorer) was designed with a philosophy of 'content over chrome', there were no reliable trustworthy pixels," he says. "I begged for a persistent trust badge to adorn the bottom-right of the screen - showing a security origin and a lock - but was overruled." He says one Microsoft security wonk built a "visually-perfect" Paypal phishing site that duped the browser and threw fake indicators. "It was terrifying stuff, mitigated only by the hope that no one would use the new mode." The breaching of the line of death is a boon to picture-in-picture phishing attacks, in which attackers create what appear to be fully functional browsers within a browser.
Immaculate reproductions of browsers including the trusted sections above the line of death have been created that fool even eagle-eyed researchers. Microsoft's own security researchers in 2007 would find picture-in-picture attacks to be virtually perfect.

The team of four wrote, in a paper titled An Evaluation of Extended Validation and Picture-in-Picture Phishing Attacks wrote in the paper [PDF] that the attack vector was so compelling it beat all other phishing techniques including homograph tricks in which letters of legitimate URLs are replaced with visually similar equivalents from, for example, the Cyrillic alphabet. Everything is untrusted: The line of death dies in HTML5.
Image: Lawrence. Picture-in-picture attacks also rendered ineffective the then-new extended validation SSL certificate scheme for determining malicious sites.

Extended validation, now mainstream, displays a green address bar padlock for participating and verified sites.

The inconvenient research spooked one large certificate vendor then in talks with Redmond over buddying up for the then new certificates. The line of death receded further with the advent of HTML 5, which brought with it the ability for websites, and phishers, to push browsers into fullscreen mode which wiped any line between trusted and untrusted content. And the line is all-but-absent on mobile devices, where simplicity and minimalism is king. "We are seeing a lot more hits on phishing links in mobile because it is so much harder to extract necessary information," Sophos senior technology consultant Sean Richmond tells El Reg . "Expanding the URLs is more difficult and it is harder to get the information users need to make decisions, so security awareness can suffer." Email apps are similarly breaching the line of death. Outlook's modern versions place a trusted message of "this message is from a trusted sender" within the untrusted email contents window, allowing phishers to replicate the notice. "Security UI is hard," Lawrence says. ® Sponsored: Customer Identity and Access Management

Windows 10 Anniversary Update crushed exploits without need of patches

Microsoft security boffins throw fresh CVEs at unpatched OS, emerge smiling Microsoft says its Windows 10 Anniversary Update squashes more exploit delivery chains than ever. The August updates brought in a series of operating system security improvements including boosts to Windows Defender and use of AppContainer, designed to raise the difficulty of having zero day exploits execute on patched systems. Redmond's security team tested its exploit mitigations against two kernel-level then zero-day exploits (CVE-2016-7255, CVE-2016-7256) used by active hacking groups that offer privilege escalation. They find, in a technical analysis designed to stress test the resilience of Windows 10, that the bugs were neutered on Anniversary Update machines even before it issued the respective November patch thanks to the exploit mitigation controls. "Because it takes time to hunt for vulnerabilities and it is virtually impossible to find all of them, such security enhancements can be critical in preventing attacks based on zero-day exploits," the team says. "While fixing a single-point vulnerability helps neutralize a specific bug, Microsoft security teams continue to look into opportunities to introduce more and more mitigation techniques. "Such mitigation techniques can break exploit methods, providing a medium-term tactical benefit, or close entire classes of vulnerabilities for long-term strategic impact." The team points to the benefits of easy and complex mitigations including simple changes against RW primitives that trigger harmless blue screens of death errors. Pushing font-parsing code to isolated containers under improvements to AppContainer and additional validation for font file parsing significantly reduced the ability to use font bugs for privilege escalation, the team says. That shut the door on one South Korean hacking group which used CVE-2016-7256 in small but targeted attacks in the nation. "Windows 10 Anniversary Update introduced many other mitigation techniques in core Windows components and the Microsoft Edge browser, helping protect customers from entire classes of exploits for very recent and even undisclosed vulnerabilities," the team says. The updates follow Microsoft's decision to delay the axing of the lauded enhanced mitigation toolkit to 31 July next year. That move sparked the ire of Carnegie Mellon University CERT boffin Will Dormann who says the toolkit significantly improved the exploit mitigation chops of Windows 10 and should be maintained, not dropped. ® Sponsored: Customer Identity and Access Management

MS17-004 – Important: Security Update for Local Security Authority Subsystem Service...

Security Update for Local Security Authority Subsystem Service (3216771)Published: January 10, 2017Version: 1.0A denial of service vulnerability exists in the way the Local Security Authority Subsystem Service (LSASS) handles authentication requests.

An attacker who successfully exploited the vulnerability could cause a denial of service on the target system's LSASS service, which triggers an automatic reboot of the system.This security update is rated Important for Microsoft Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 (and Server Core).

For more information, see the Affected Software and Vulnerability Severity Ratings section.The security update addresses the vulnerability by changing the way that LSASS handles specially crafted authentication requests.For more information about the vulnerability, see the Vulnerability Information section.

For more information about this update, see Microsoft Knowledge Base Article 3216771.The following software versions or editions are affected.
Versions or editions that are not listed are either past their support life cycle or are not affected.

To determine the support life cycle for your software past version or edition, see Microsoft Support Lifecycle.The severity ratings indicated for each affected software assume the potential maximum impact of the vulnerability.

For information regarding the likelihood, within 30 days of this security bulletin’s release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the January bulletin summary.[1]Beginning with the October 2016 release, Microsoft is changing the update servicing model for Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, and Windows Server 2012 R2.

For more information, please see this Microsoft TechNet article.*The Updates Replaced column shows only the latest update in any chain of superseded updates.

For a comprehensive list of updates replaced, go to the Microsoft Update Catalog, search for the update KB number, and then view update details (updates replaced information is provided on the Package Details tab).Local Security Authority Subsystem Service Denial of Service Vulnerability - CVE-2017-0004A denial of service vulnerability exists in the way the Local Security Authority Subsystem Service (LSASS) handles authentication requests.

An attacker who successfully exploited the vulnerability could cause a denial of service on the target system's LSASS service, which triggers an automatic reboot of the system.To exploit the vulnerability an unauthenticated attacker could send a specially crafted authentication request.The security update addresses the vulnerability by changing the way that LSASS handles specially crafted authentication requests.The following table contains links to the standard entry for each vulnerability in the Common Vulnerabilities and Exposures list: Vulnerability title CVE number Publicly disclosed Exploited Local Security Authority Subsystem Service Denial of Service Vulnerability CVE-2017-0004 Yes No Mitigating FactorsMicrosoft has not identified any mitigating factors for this vulnerability.WorkaroundsMicrosoft has not identified any workarounds for this vulnerability.For Security Update Deployment information, see the Microsoft Knowledge Base article referenced here in the Executive Summary.Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.
See Acknowledgments for more information.The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose.
In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages.
Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.V1.0 (January 10, 2017): Bulletin published. Page generated 2017-01-09 15:20-08:00.

MS17-003 – Critical: Security Update for Adobe Flash Player (3214628) –...

Security Update for Adobe Flash Player (3214628)Published: January 10, 2017Version: 1.0This security update resolves vulnerabilities in Adobe Flash Player when installed on all supported editions of Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, Windows 10, and Windows Server 2016.This security update is rated Critical.

The update addresses the vulnerabilities in Adobe Flash Player by updating the affected Adobe Flash libraries contained within Internet Explorer 10, Internet Explorer 11, and Microsoft Edge.

For more information, see the Affected Software section.For more information about this update, see Microsoft Knowledge Base Article 3214628.This security update addresses the following vulnerabilities, which are described in Adobe Security Bulletin APSB17-02:CVE-2017-2925, CVE-2017-2926, CVE-2017-2927, CVE-2017-2928, CVE-2017-2930, CVE-2017-2931, CVE-2017-2932, CVE-2017-2933, CVE-2017-2934, CVE-2017-2935, CVE-2017-2936, CVE-2017-2937The following software versions or editions are affected.
Versions or editions that are not listed are either past their support life cycle or are not affected.

To determine the support life cycle for your software version or edition, see Microsoft Support Lifecycle. Operating System Component Aggregate Severity and Impact Updates Replaced*            Windows 8.1 Windows 8.1 for 32-bit Systems Adobe Flash Player(3214628) CriticalRemote Code Execution 3209498 in MS16-154 Windows 8.1 for x64-based Systems Adobe Flash Player(3214628) CriticalRemote Code Execution 3209498 in MS16-154 Windows Server 2012 and Windows Server 2012 R2 Windows Server 2012 Adobe Flash Player(3214628) ModerateRemote Code Execution 3209498 in MS16-154 Windows Server 2012 R2 Adobe Flash Player(3214628) ModerateRemote Code Execution 3209498 in MS16-154 Windows RT 8.1 Windows RT 8.1 Adobe Flash Player(3214628)[1] CriticalRemote Code Execution 3209498 in MS16-154 Windows 10 Windows 10 for 32-bit Systems Adobe Flash Player(3214628)[2] CriticalRemote Code Execution 3209498 in MS16-154 Windows 10 for x64-based Systems Adobe Flash Player(3214628)[2] CriticalRemote Code Execution 3209498 in MS16-154 Windows 10 Version 1511 for 32-bit Systems Adobe Flash Player(3214628)[2] CriticalRemote Code Execution 3209498 in MS16-154 Windows 10 Version 1511 for x64-based Systems Adobe Flash Player(3214628)[2] CriticalRemote Code Execution 3209498 in MS16-154 Windows 10 Version 1607 for 32-bit Systems Adobe Flash Player(3214628)[2] CriticalRemote Code Execution 3209498 in MS16-154 Windows 10 Version 1607 for x64-based Systems Adobe Flash Player(3214628)[2] CriticalRemote Code Execution 3209498 in MS16-154 Windows Server 2016 Windows Server 2016 for 64-bit Systems Adobe Flash Player(3214628)[2] CriticalRemote Code Execution 3209498 in MS16-154 [1]This update is available via Windows Update.[2]The Adobe Flash Player updates for Windows 10 updates are available via Windows Update or via the Microsoft Update Catalog.*The Updates Replaced column shows only the latest update in any chain of superseded updates.

For a comprehensive list of updates replaced, go to the Microsoft Update Catalog, search for the update KB number, and then view update details (updates replaced information is provided on the Package Details tab).How could an attacker exploit these vulnerabilities? In a web-based attack scenario where the user is using Internet Explorer for the desktop, an attacker could host a specially crafted website that is designed to exploit any of these vulnerabilities through Internet Explorer and then convince a user to view the website.

An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the IE rendering engine.

The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements.

These websites could contain specially crafted content that could exploit any of these vulnerabilities.
In all cases, however, an attacker would have no way to force users to view the attacker-controlled content.
Instead, an attacker would have to convince users to take action, typically by clicking a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email.In a web-based attack scenario where the user is using Internet Explorer in the Windows 8-style UI, an attacker would first need to compromise a website already listed in the Compatibility View (CV) list.

An attacker could then host a website that contains specially crafted Flash content designed to exploit any of these vulnerabilities through Internet Explorer and then convince a user to view the website.

An attacker would have no way to force users to view the attacker-controlled content.
Instead, an attacker would have to convince users to take action, typically by clicking a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email.

For more information about Internet Explorer and the CV List, please see the MSDN Article, Developer Guidance for websites with content for Adobe Flash Player in Windows 8.Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability.

The following mitigating factors may be helpful in your situation:In a web-based attack scenario where the user is using Internet Explorer for the desktop, an attacker could host a website that contains a webpage that is used to exploit any of these vulnerabilities.
In addition, compromised websites and websites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit any of these vulnerabilities.
In all cases, however, an attacker would have no way to force users to visit these websites.
Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes users to the attacker's website. Internet Explorer in the Windows 8-style UI will only play Flash content from sites listed on the Compatibility View (CV) list.

This restriction requires an attacker to first compromise a website already listed on the CV list.

An attacker could then host specially crafted Flash content designed to exploit any of these vulnerabilities through Internet Explorer and then convince a user to view the website.

An attacker would have no way to force users to view the attacker-controlled content.
Instead, an attacker would have to convince users to take action, typically by clicking a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email. By default, all supported versions of Microsoft Outlook and Windows Live Mail open HTML email messages in the Restricted sites zone.

The Restricted sites zone, which disables scripts and ActiveX controls, helps reduce the risk of an attacker being able to use any of these vulnerabilities to execute malicious code.
If a user clicks a link in an email message, the user could still be vulnerable to exploitation of any of these vulnerabilities through the web-based attack scenario. By default, Internet Explorer on Windows Server 2012 and Windows Server 2012 R2 runs in a restricted mode that is known as Enhanced Security Configuration.

This mode can help reduce the likelihood of the exploitation of these Adobe Flash Player vulnerabilities in Internet Explorer. Workaround refers to a setting or configuration change that would help block known attack vectors before you apply the update.Prevent Adobe Flash Player from running You can disable attempts to instantiate Adobe Flash Player in Internet Explorer and other applications that honor the kill bit feature, such as Office 2007 and Office 2010, by setting the kill bit for the control in the registry. Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk. To set the kill bit for the control in the registry, perform the following steps: Paste the following into a text file and save it with the .reg file extension. Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}] "Compatibility Flags"=dword:00000400 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}] "Compatibility Flags"=dword:00000400 Double-click the .reg file to apply it to an individual system.You can also apply this workaround across domains by using Group Policy.

For more information about Group Policy, see the TechNet article, Group Policy collection. Note You must restart Internet Explorer for your changes to take effect. Impact of workaround.

There is no impact as long as the object is not intended to be used in Internet Explorer. How to undo the workaround. Delete the registry keys that were added in implementing this workaround.  Prevent Adobe Flash Player from running in Internet Explorer through Group Policy Note The Group Policy MMC snap-in can be used to set policy for a machine, for an organizational unit, or for an entire domain.

For more information about Group Policy, visit the following Microsoft Web sites: Group Policy Overview What is Group Policy Object Editor? Core Group Policy tools and settings To disable Adobe Flash Player in Internet Explorer through Group Policy, perform the following steps: Note This workaround does not prevent Flash from being invoked from other applications, such as Microsoft Office 2007 or Microsoft Office 2010. Open the Group Policy Management Console and configure the console to work with the appropriate Group Policy object, such as local machine, OU, or domain GPO. Navigate to the following node:Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Add-on Management Double-click Turn off Adobe Flash in Internet Explorer and prevent applications from using Internet Explorer technology to instantiate Flash objects. Change the setting to Enabled. Click Apply and then click OK to return to the Group Policy Management Console. Refresh Group Policy on all systems or wait for the next scheduled Group Policy refresh interval for the settings to take effect.  Prevent Adobe Flash Player from running in Office 2010 on affected systems Note This workaround does not prevent Adobe Flash Player from running in Internet Explorer. Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk. For detailed steps that you can use to prevent a control from running in Internet Explorer, see Microsoft Knowledge Base Article 240797.

Follow the steps in the article to create a Compatibility Flags value in the registry to prevent a COM object from being instantiated in Internet Explorer. To disable Adobe Flash Player in Office 2010 only, set the kill bit for the ActiveX control for Adobe Flash Player in the registry using the following steps: Create a text file named Disable_Flash.reg with the following contents: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common\COM\Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}] "Compatibility Flags"=dword:00000400 Double-click the .reg file to apply it to an individual system. Note You must restart Internet Explorer for your changes to take effect. You can also apply this workaround across domains by using Group Policy.

For more information about Group Policy, see the TechNet article, Group Policy collection. Prevent ActiveX controls from running in Office 2007 and Office 2010 To disable all ActiveX controls in Microsoft Office 2007 and Microsoft Office 2010, including Adobe Flash Player in Internet Explorer, perform the following steps: Click File, click Options, click Trust Center, and then click Trust Center Settings. Click ActiveX Settings in the left-hand pane, and then select Disable all controls without notifications. Click OK to save your settings. Impact of workaround. Office documents that use embedded ActiveX controls may not display as intended. How to undo the workaround. To re-enable ActiveX controls in Microsoft Office 2007 and Microsoft Office 2010, perform the following steps: Click File, click Options, click Trust Center, and then click Trust Center Settings. Click ActiveX Settings in the left-hand pane, and then deselect Disable all controls without notifications. Click OK to save your settings. Set Internet and Local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones You can help protect against exploitation of these vulnerabilities by changing your settings for the Internet security zone to block ActiveX controls and Active Scripting. You can do this by setting your browser security to High. To raise the browsing security level in Internet Explorer, perform the following steps: On the Internet Explorer Tools menu, click Internet Options. In the Internet Options dialog box, click the Security tab, and then click Internet. Under Security level for this zone, move the slider to High.

This sets the security level for all websites you visit to High. Click Local intranet. Under Security level for this zone, move the slider to High.

This sets the security level for all websites you visit to High. Click OK to accept the changes and return to Internet Explorer. Note If no slider is visible, click Default Level, and then move the slider to High. Note Setting the level to High may cause some websites to work incorrectly.
If you have difficulty using a website after you change this setting, and you are sure the site is safe to use, you can add that site to your list of trusted sites.

This will allow the site to work correctly even with the security setting set to High. Impact of workaround. There are side effects to blocking ActiveX Controls and Active Scripting. Many websites on the Internet or an intranet use ActiveX or Active Scripting to provide additional functionality.

For example, an online e-commerce site or banking site may use ActiveX Controls to provide menus, ordering forms, or even account statements.

Blocking ActiveX Controls or Active Scripting is a global setting that affects all Internet and intranet sites.
If you do not want to block ActiveX Controls or Active Scripting for such sites, use the steps outlined in "Add sites that you trust to the Internet Explorer Trusted sites zone".   Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone You can help protect against exploitation of these vulnerabilities by changing your settings to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.

To do this, perform the following steps: In Internet Explorer, click Internet Options on the Tools menu. Click the Security tab. Click Internet, and then click Custom Level. Under Settings, in the Scripting section, under Active Scripting, click Prompt or Disable, and then click OK. Click Local intranet, and then click Custom Level. Under Settings, in the Scripting section, under Active Scripting, click Prompt or Disable, and then click OK. Click OK to return to Internet Explorer, and then click OK again. Note Disabling Active Scripting in the Internet and Local intranet security zones may cause some websites to work incorrectly.
If you have difficulty using a website after you change this setting, and you are sure the site is safe to use, you can add that site to your list of trusted sites.

This will allow the site to work correctly. Impact of workaround. There are side effects to prompting before running Active Scripting. Many websites that are on the Internet or on an intranet use Active Scripting to provide additional functionality.

For example, an online e-commerce site or banking site may use Active Scripting to provide menus, ordering forms, or even account statements. Prompting before running Active Scripting is a global setting that affects all Internet and intranet sites. You will be prompted frequently when you enable this workaround.

For each prompt, if you feel you trust the site that you are visiting, click Yes to run Active Scripting.
If you do not want to be prompted for all these sites, use the steps outlined in "Add sites that you trust to the Internet Explorer Trusted sites zone".   Add sites that you trust to the Internet Explorer Trusted sites zone After you set Internet Explorer to require a prompt before it runs ActiveX controls and Active Scripting in the Internet zone and in the Local intranet zone, you can add sites that you trust to the Internet Explorer Trusted sites zone.

This will allow you to continue to use trusted websites exactly as you do today, while helping to protect you from this attack on untrusted sites. We recommend that you add only sites that you trust to the Trusted sites zone. To do this, perform the following steps: In Internet Explorer, click Tools, click Internet Options, and then click the Security tab. In the Select a web content zone to specify its current security settings box, click Trusted Sites, and then click Sites. If you want to add sites that do not require an encrypted channel, click to clear the Require server verification (https:) for all sites in this zone check box. In the Add this website to the zone box, type the URL of a site that you trust, and then click Add. Repeat these steps for each site that you want to add to the zone. Click OK two times to accept the changes and return to Internet Explorer. Note Add any sites that you trust not to take malicious action on your system.

Two sites in particular that you may want to add are *.windowsupdate.microsoft.com and *.update.microsoft.com.

These are the sites that will host the update, and they require an ActiveX control to install the update. For Security Update Deployment information, see the Microsoft Knowledge Base article referenced here in the Executive Summary.Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.
See Acknowledgments for more information.The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose.
In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages.
Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.V1.0 (January, 10 2017): Bulletin published. Page generated 2017-01-03 9:18Z-08:00.

MS17-JAN – Microsoft Security Bulletin Summary for January 2017 – Version:...

The following tables list the bulletins in order of major software category and severity.Use these tables to learn about the security updates that you may need to install. You should review each software program or component listed to see whether any security updates pertain to your installation.
If a software program or component is listed, then the severity rating of the software update is also listed.Note You may have to install several security updates for a single vulnerability. Review the whole column for each bulletin identifier that is listed to verify the updates that you have to install, based on the programs or components that you have installed on your system. Windows Vista Bulletin Identifier MS17-001 MS17-003 MS17-004 Aggregate Severity Rating None None Important Windows Vista for Service Pack 2 Not applicable Not applicable Windows Vista for Service Pack 2(3216775)(Important) Windows Vista x64 Edition Service Pack 2 Not applicable Not applicable Windows Vista x64 Edition Service Pack 2(3216775)(Important) Windows Server 2008 Bulletin Identifier MS17-001 MS17-003 MS17-004 Aggregate Severity Rating None None Important Windows Server 2008 for 32-bit Systems Service Pack 2 Not applicable Not applicable Windows Server 2008 for 32-bit Systems Service Pack 2(3216775)(Important) Windows Server 2008 for x64-based Systems Service Pack 2 Not applicable Not applicable Windows Server 2008 for x64-based Systems Service Pack 2(3216775)(Important) Windows Server 2008 for Itanium-based Systems Service Pack 2 Not applicable Not applicable Windows Server 2008 for Itanium-based Systems Service Pack 2(3216775)(Important) Windows 7 Bulletin Identifier MS17-001 MS17-003 MS17-004 Aggregate Severity Rating None None Important Windows 7 for x32-bit Systems Service Pack 1Security Only Not applicable Not applicable Windows 7 for x32-bit Systems Service Pack 1(3212642)(Important) Windows 7 for x64-based Systems Service Pack 1Monthly Rollup Not applicable Not applicable Windows 7 for x64-based Systems Service Pack 1(3212646)(Important) Windows 7 for x32-bit Systems Service Pack 1Security Only Not applicable Not applicable Windows 7 for x32-bit Systems Service Pack 1(3212642)(Important) Windows 7 for x64-based Systems Service Pack 1Monthly Rollup Not applicable Not applicable Windows 7 for x64-based Systems Service Pack 1(3212646)(Important) Windows Server 2008 R2 Bulletin Identifier MS17-001 MS17-003 MS17-004 Aggregate Severity Rating None None Important Windows Server 2008 R2 for x64-based Systems Service Pack 1Security Only Not applicable Not applicable Windows Server 2008 R2 for x64-based Systems Service Pack(3212642)(Important) Windows Server 2008 R2 for x64-based Systems Service Pack 1Monthly Rollup Not applicable Not applicable Windows Server 2008 R2 for x64-based Systems Service Pack 1(3212646)(Important) Windows Server 2008 R2 for Itanium-based Systems Service Pack 1Security Only Not applicable Not applicable Windows Server 2008 R2 for Itanium-based Systems Service Pack 1(3212642)(Important) Windows Server 2008 R2 for Itanium-based Systems Service Pack 1Monthly Rollup Not applicable Not applicable Windows Server 2008 R2 for Itanium-based Systems Service Pack 1(3212646)(Important) Windows 8.1 Bulletin Identifier MS17-001 MS17-003 MS17-004 Aggregate Severity Rating None Critcal None Windows 8.1 for 32-bit SystemsSecurity Only Not applicable Adobe Flash Player(3214628)(Critical) Not applicable Windows 8.1 for 32-bit SystemsMonthly Rollup Not applicable Not applicable Not applicable Windows 8.1 for x64-based SystemsSecurity Only Not applicable Adobe Flash Player(3214628)(Critical) Not applicable Windows 8.1 for x64-based SystemsMonthly Rollup Not applicable Not applicable Not applicable Windows Server 2012 and Windows Server 2012 R2 Bulletin Identifier MS17-001 MS17-003 MS17-004 Aggregate Severity Rating None Moderate None Windows Server 2012Security Only Not applicable Adobe Flash Player(3214628)(Moderate) Not applicable Windows Server 2012Monthly Rollup Not applicable Not applicable Not applicable Windows Server 2012 R2Security Only Not applicable Adobe Flash Player(3214628)(Moderate) Not applicable Windows Server 2012 R2Monthly Rollup Not applicable Not applicable Not applicable Windows RT 8.1 Bulletin Identifier MS17-001 MS17-003 MS17-004 Aggregate Severity Rating None Critical None Windows RT 8.1Monthly Rollup Not applicable Adobe Flash Player(3214628)(Critical) Not applicable Windows 10 Bulletin Identifier MS17-001 MS17-003 MS17-004 Aggregate Severity Rating Important Critical None Windows 10 for 32-bit Systems Microsoft Edge(3210720)(Critical) Adobe Flash Player(3214628)(Critical) Not applicable Windows 10 for x64-based Systems Microsoft Edge(3210720)(Critical) Adobe Flash Player(3214628)(Critical) Not applicable Windows 10 Version 1511 for 32-bit Systems Microsoft Edge(3210721)(Critical) Adobe Flash Player(3214628)(Critical) Not applicable Windows 10 Version 1511 for x64-based Systems Microsoft Edge(3210721)(Critical) Adobe Flash Player(3214628)(Critical) Not applicable Windows 10 Version 1607 for 32-bit Systems Microsoft Edge(3211320)(Critical) Adobe Flash Player(3214628)(Critical) Not applicable Windows 10 Version 1607 for x64-based Systems Microsoft Edge(3211320)(Critical) Adobe Flash Player(3214628)(Critical) Not applicable Windows Server 2016 Bulletin Identifier MS17-001 MS17-003 MS17-004 Aggregate Severity Rating Moderate Critical None Windows Server 2016 for x64-based Systems Microsoft Edge(3211320)(Moderate) Adobe Flash Player(3214628)(Critical) Not applicable Server Core installation option Bulletin Identifier MS17-001 MS17-003 MS17-004 Aggregate Severity Rating Moderate None Important Windows Server 2008 for 32-bit Systems Service Pack 2(Server Core installation) Not applicable Not applicable Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)(3216775)(Important) Windows Server 2008 for x64-based Systems Service Pack 2(Server Core installation) Not applicable Not applicable Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)(3216775)(Important) Windows Server 2008 R2 for x64-based Systems Service Pack 1(Server Core installation)Security Only Not applicable Not applicable Windows Server 2008 R2 for x64-based Systems Service Pack (Server Core installation)(3212642)(Important) Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)Monthly Rollup Not applicable Not applicable Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)(3212646)(Important) Windows Server 2012(Server Core installation)Security Only Not applicable Not applicable Not applicable Windows Server 2012(Server Core installation)Monthly Rollup Not applicable Not applicable Not applicable Windows Server 2012 R2(Server Core installation)Security Only Not applicable Not applicable Not applicable Windows Server 2012 R2(Server Core installation)Monthly Rollup Not applicable Not applicable Not applicable Windows Server 2016 for x64-based Systems(Server Core installation) Not applicable Not applicable Not applicable

MS17-002 – Important: Security Update for Microsoft Office (3214291) – Version:...

Security Update for Microsoft Office (3214291)Published: January 10, 2017Version: 1.1This security update resolves a vulnerability in Microsoft Office.

The vulnerability could allow remote code execution if a user opens a specially crafted Microsoft Office file.

An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.

Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.The security update addresses the vulnerability by correcting how affected versions of Office and Office components handle objects in memory.For more information about the vulnerability, see the Vulnerability Information section.For more information about this update, see Microsoft Knowledge Base Article 3214291.The following software versions or editions are affected.
Versions or editions that are not listed are either past their support life cycle or are not affected.

To determine the support life cycle for your software version or edition, see Microsoft Support Lifecycle.The following severity ratings assume the potential maximum impact of the vulnerability.

For information regarding the likelihood, within 30 days of this security bulletin's release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the January bulletin summary.Note Please see the Security Update Guide for a new approach to consuming the security update information. You can customize your views and create affected software spreadsheets, as well as download data via a restful API.

For more information, please see the Security Updates Guide FAQ.

As a reminder, the Security Updates Guide will be replacing security bulletins as of February 2017. Please see our blog post, Furthering our commitment to security updates, for more details.Microsoft Office SoftwareMicrosoft Server Software*The Updates Replaced column shows only the latest update in a chain of superseded updates.

For a comprehensive list of updates replaced, go to the Microsoft Update Catalog, search for the update number, and then view update details (updates replaced information is on the Package Details tab).I am being offered this update for software that is not specifically indicated as being affected in the Affected Software and Vulnerability Severity Ratings table. Why am I being offered this update? When updates address vulnerable code that exists in a component that is shared between multiple Microsoft Office products or shared between multiple versions of the same Microsoft Office product, the update is considered to be applicable to all supported products and versions that contain the vulnerable component.For example, when an update applies to Microsoft Office 2007 products, only Microsoft Office 2007 may be specifically listed in the Affected Software table. However, the update could apply to Microsoft Word 2007, Microsoft Excel 2007, Microsoft Visio 2007, Microsoft Compatibility Pack, Microsoft Excel Viewer, or any other Microsoft Office 2007 product that is not specifically listed in the Affected Software table.

Furthermore, when an update applies to Microsoft Office 2010 products, only Microsoft Office 2010 may be specifically listed in the Affected Software table. However, the update could apply to Microsoft Word 2010, Microsoft Excel 2010, Microsoft Visio 2010, Microsoft Visio Viewer, or any other Microsoft Office 2010 product that is not specifically listed in the Affected Software table.For more information on this behavior and recommended actions, see Microsoft Knowledge Base Article 830335.

For a list of Microsoft Office products that an update may apply to, refer to the Microsoft Knowledge Base Article associated with the specific update.Microsoft Office Memory Corruption VulnerabilityA remote code execution vulnerability exists in Microsoft Office software when the Office software fails to properly handle objects in memory.

An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
If the current user is logged on with administrative user rights, an attacker could take control of the affected system.

An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office software.
In an email attack scenario an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file.
In a web-based attack scenario an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability.

An attacker would have no way to force users to visit the website.
Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince them to open the specially crafted file.Note that the Preview Pane is not an attack vector for this vulnerability.

The security update addresses the vulnerability by correcting how Office handles objects in memory.  Vulnerability title CVE number Publicly disclosed Exploited Microsoft Office Memory Corruption Vulnerability CVE-2017-0003 No No Mitigating FactorsMicrosoft has not identified any mitigating factors for this vulnerability.WorkaroundsMicrosoft has not identified any workarounds for this vulnerability.For Security Update Deployment information see the Microsoft Knowledge Base article referenced here in the Executive Summary.Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.
See Acknowledgments for more information. The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose.
In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages.
Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.V1.0 (January 10, 2017): Bulletin published. V1.1 (January 10, 2017): Changed severity to Important. Page generated 2017-01-10 11:37-08:00.

MS17-001 – Important: Security Update for Microsoft Edge (3214288) – Version:...

Security Update for Microsoft Edge (3214288)Published: January 10, 2017Version: 1.0This security update resolves a vulnerability in Microsoft Edge.

This vulnerability could allow elevation of privilege if a user views a specially crafted webpage using Microsoft Edge.

An attacker who successfully exploited the vulnerability could elevate privileges in affected versions of Microsoft Edge.This security update is rated Important for Microsoft Edge on Windows 10 and Windows Server 2016.

For more information, see the Affected Software section.The update addresses the vulnerability by assigning a unique origin to top-level windows that navigate to Data URLs.For more information about the vulnerability, see the Vulnerability Information section.

For more information about this update, see Microsoft Knowledge Base Article 3214288.The following software versions or editions are affected.
Versions or editions that are not listed are either past their support life cycle or are not affected.

To determine the support life cycle for your software past version or edition, see Microsoft Support Lifecycle.The severity ratings indicated for each affected software assume the potential maximum impact of the vulnerability.

For information regarding the likelihood, within 30 days of this security bulletin’s release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the January bulletin summary.Note Please see the Security Update Guide for a new approach to consuming the security update information. You can customize your views and create affected software spreadsheets, as well as download data via a restful API.

For more information, please see the Security Updates Guide FAQ.

As a reminder, the Security Updates Guide will be replacing security bulletins as of February 2017. Please see our blog post, Furthering our commitment to security updates, for more details.[1] Windows 10 and Windows Server 2016 updates are cumulative.

The monthly security release includes all security fixes for vulnerabilities that affect Windows 10, in addition to non-security updates.

The updates are available via the Microsoft Update Catalog. Please note that effective December 13, 2016, Windows 10 and Windows Server 2016 details for the Cumulative Updates will be documented in Release Notes. Please refer to the Release Notes for OS Build numbers, Known Issues, and affected file list information.*The Updates Replaced column shows only the latest update in any chain of superseded updates.

For a comprehensive list of updates replaced, go to the Microsoft Update Catalog, search for the update KB number, and then view update details (updates replaced information is provided on the Package Details tab).Microsoft Edge Elevation of Privilege Vulnerability- CVE-2017-0002An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies with about:blank, which could allow an attacker to access information from one domain and inject it into another domain.

An attacker who successfully exploited this vulnerability could elevate privileges in affected versions of Microsoft Edge.In a web-based attack scenario, an attacker could host a website that is used to attempt to exploit the vulnerability.
In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit the vulnerability.
In all cases, however, an attacker would have no way to force users to view the attacker-controlled content.
Instead, an attacker would have to convince users to take action.

For example, an attacker could trick users into clicking a link that takes them to the attacker's site.The update addresses the vulnerability by assigning a unique origin to top-level windows that navigate to Data URLs.The following table contain a link to the standard entry for each vulnerability in the Common Vulnerabilities and Exposures list: Vulnerability title CVE number Publicly disclosed Exploited Microsoft Edge Elevation of Privilege Vulnerability CVE-2017-0002 Yes No Mitigating FactorsMicrosoft has not identified any mitigating factors for this vulnerability.WorkaroundsMicrosoft has not identified any workarounds for this vulnerability.For Security Update Deployment information, see the Microsoft Knowledge Base article referenced here in the Executive Summary.Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.
See Acknowledgments for more information.The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose.
In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages.
Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.V1.0 (January 10, 2017): Bulletin published. Page generated 2017-01-10 10:04-08:00.