KLA11911 Multiple vulnerabilites in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products (Extended Support Update). Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, obtain sensitive information, perform cross-site scripting attack.

Below is a complete list of vulnerabilities:

1. An elevation of privilege vulnerability in WPAD can be exploited remotely to gain privileges.
2. An information disclosure vulnerability in Windows Graphics Component can be exploited remotely via specially crafted application to obtain sensitive information.
3. A remote code execution vulnerability in Windows NetLogon Memory Corruption can be exploited remotely via specially crafted to execute arbitrary code.
4. A memory corruption vulnerability in Internet Explorer can be exploited remotely via specially crafted website to execute arbitrary code.
5. An elevation of privilege vulnerability in Windows SMB Server can be exploited remotely via specially crafted application to gain privileges.
6. An elevation of privilege vulnerability in Group Policy can be exploited remotely to gain privileges.
7. An elevation of privilege vulnerability in Win32k can be exploited remotely via specially crafted application to gain privileges.
8. An elevation of privilege vulnerability in OpenType Font Driver can be exploited remotely via specially crafted application to gain privileges.
9. A cross-site scripting (XSS) in Microsoft Internet Explorer can be exploited remotely via specially crafted content to execute arbitrary code.
10. A memory corruption vulnerability in Scripting Engine can be exploited remotely via specially crafted website to execute arbitrary code.
11. An elevation of privilege vulnerability in Windows WPAD Proxy Discovery can be exploited remotely to gain privileges.
12. An elevation of privilege vulnerability in NetBIOS can be exploited remotely to gain privileges.

Original advisories

CVE-2016-3213

CVE-2016-3216

CVE-2016-3228

CVE-2016-0200

CVE-2016-3225

CVE-2016-3223

CVE-2016-3221

CVE-2016-3220

CVE-2016-3212

CVE-2016-0199

CVE-2016-3211

CVE-2016-3205

CVE-2016-3236

CVE-2016-3207

CVE-2016-3206

CVE-2016-3299

CVE-2016-3218

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Internet-Explorer

Microsoft-Windows

Microsoft-Windows-Server

Microsoft-Windows-Vista-4

Microsoft-Windows-Server-2012

Microsoft-Windows-8

Microsoft-Windows-7

Microsoft-Windows-Server-2008

Windows-RT

Microsoft-Windows-10

CVE list

CVE-2016-3207 critical

CVE-2016-3206 critical

CVE-2016-3205 critical

CVE-2016-3213 critical

CVE-2016-3212 high

CVE-2016-3211 critical

CVE-2016-0199 critical

CVE-2016-0200 critical

CVE-2016-3220 critical

CVE-2016-3218 critical

CVE-2016-3216 warning

CVE-2016-3299 high

CVE-2016-3236 critical

CVE-2016-3228 critical

CVE-2016-3225 critical

CVE-2016-3223 critical

CVE-2016-3221 critical

KB list

3161561

3159398

3161949

3161664

3164033

3164035

3160005

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• XSS/CSS

Cross site scripting. Exploitation of vulnerabilities with this impact can lead to partial interception of information transmitted between user and site.

Affected Products

• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)Windows 10 for 32-bit SystemsVBScript 5.7Windows Vista x64 Edition Service Pack 2Internet Explorer 9Windows 10 for x64-based SystemsWindows Server 2012 (Server Core installation)Windows 7 for x64-based Systems Service Pack 1Windows 8.1 for 32-bit systemsWindows 8.1 for x64-based systemsWindows Server 2008 for 32-bit Systems Service Pack 2Windows Server 2012Windows Vista Service Pack 2Internet Explorer 11Windows Server 2008 for x64-based Systems Service Pack 2Windows RT 8.1Windows Server 2008 for Itanium-Based Systems Service Pack 2Windows Server 2012 R2 (Server Core installation)Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1Windows 10 Version 1511 for 32-bit SystemsWindows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)Windows 10 Version 1511 for x64-based SystemsVBScript 5.8Windows 7 for 32-bit Systems Service Pack 1Windows Server 2008 R2 for x64-based Systems Service Pack 1Internet Explorer 10Windows Server 2012 R2