Microsoft Security Bulletin MS15-067 - Critical

Vulnerability in RDP Could Allow Remote Code Execution (3073094)

Published: July 14, 2015 | Updated: August 21, 2015

Version: 1.1

Executive Summary

This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if an attacker sends a specially crafted sequence of packets to a targeted system with the Remote Desktop Protocol (RDP) server service enabled. By default, the RDP server service is not enabled on any Windows operating system. Systems that do not have the RDP server service enabled are not at risk.

This security update is rated Critical for affected editions of Windows 7, Windows 8, and Windows Server 2012. For more information, see the Affected Software section.

The security update addresses the vulnerability by modifying how the terminal service handles packets. For more information about the vulnerability, see the Vulnerability Information section.

For more information about this update, see Microsoft Knowledge Base Article 3073094.

Affected Software

The following software versions or editions are affected. Versions or editions that are not listed are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see Microsoft Support Lifecycle.

Operating System Maximum Security Impact Aggregate Severity Rating Updates Replaced*
Windows 7
Windows 7 for 32-bit Systems Service Pack 1
(3067904)
Remote Code Execution Critical 3035017 in MS15-030
Windows 7 for 32-bit Systems Service Pack 1**
(3069762)[1]
Remote Code Execution Critical 3036493 in MS15-030
Windows 7 for x64-based Systems Service Pack 1
(3067904)
Remote Code Execution Critical 3035017 in MS15-030
Windows 7 for x64-based Systems Service Pack 1
(3069762)[1]
Remote Code Execution Critical 3036493 in MS15-030
**Windows 8
Windows 8 for 32-bit Systems
(3067904)
Remote Code Execution Critical 2965788 and 3035017 in MS15-030
Windows 8 for x64-based Systems
(3067904)
Remote Code Execution Critical 2965788 and 3035017 in MS15-030
Windows Server 2012
Windows Server 2012
(3067904)
Remote Code Execution Critical 2965788 and 3035017 in MS15-030
Server Core installation option
Windows Server 2012 (Server Core installation)
(3067904)
Remote Code Execution Critical 2965788 and 3035017 in MS15-030

[1]Customers running RDP 8.0 on supported editions of Windows 7 need only install update 3069762. See the Update FAQ for more information.

*The Updates Replaced column shows only the latest update in a chain of superseded updates. For a comprehensive list of updates replaced, go to the Microsoft Update Catalog, search for the update KB number, and then view update details (updates replaced information is on the Package Details tab).

Update FAQ

I am running Windows 7. Why am I not being offered both updates listed in the Affected Software table for Windows 7?
The update you need to install depends on which version of RDP you have installed on your computer:

  • If you do not have any version of RDP installed, you need only install update 3067904 to be fully protected from the vulnerabilities described in this bulletin.
  • If you have RDP 8.0 installed, you need only install update 3069762 to be fully protected from the vulnerabilities described in this bulletin.

For more information about RDP 8.0, see Microsoft Knowledge Base Article 2592687.

Severity Ratings and Vulnerability Identifiers

The following severity ratings assume the potential maximum impact of the vulnerability. For information regarding the likelihood, within 30 days of this security bulletin's release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the July bulletin summary.

Vulnerability Severity Rating and Maximum Security Impact by Affected Software
Affected Software Remote Desktop Protocol (RDP) Remote Code Execution Vulnerability - CVE-2015-2373 Aggregate Severity Rating
Windows 7
Windows 7 for 32-bit Systems Service Pack 1
(3067904)
Critical
Remote Code Execution
Critical
Windows 7 for 32-bit Systems Service Pack 1
(3069762)
Critical
Remote Code Execution
Critical
Windows 7 for x64-based Systems Service Pack 1
(3067904)
Critical
Remote Code Execution
Critical
Windows 7 for x64-based Systems Service Pack 1
(3069762)
Critical
Remote Code Execution
Critical
Windows 8
Windows 8 for 32-bit Systems
(3067904)
Critical
Remote Code Execution
Critical
Windows 8 for x64-based Systems
(3067904)
Critical
Remote Code Execution
Critical
Windows Server 2012
Windows Server 2012
(3067904)
Critical
Remote Code Execution
Critical
Server Core installation option
Windows Server 2012 (Server Core installation)
(3067904)
Critical
Remote Code Execution
Critical

Vulnerability Information

Remote Desktop Protocol (RDP) Remote Code Execution Vulnerability - CVE-2015-2373

A remote code execution vulnerability exists in how the Remote Desktop Protocol (RDP) (terminal) service handles packets. While the most likely outcome of this vulnerability is denial of the remote desktop (terminal) service (DOS), remote code execution is possible.

To exploit the vulnerability, an attacker could send a specially crafted sequence of packets to a system running the RDP server service. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The update addresses the vulnerability by modifying how the terminal service handles packets.

Microsoft received information about this vulnerability through coordinated vulnerability disclosure. When this security bulletin was issued, Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers.

Mitigating Factors

Microsoft has not identified any mitigating factors for this vulnerability.

Workarounds

Microsoft has not identified any workarounds for this vulnerability.

Security Update Deployment

For Security Update Deployment information, see the Microsoft Knowledge Base article referenced here in the Executive Summary.

Acknowledgments

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure. See Acknowledgments for more information.

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

  • V1.0 (July 14, 2015): Bulletin published.
  • V1.1 (August 21, 2015): Improved the Update FAQ section and the footnote for the Affected Software table to help customers more easily identify the correct update to apply based on the currently installed version of RDP on Windows 7 systems. These are informational changes only. Customers who have already successfully applied the update do not need to take any action. Customers who have not already installed the necessary update should do so to be protected from the vulnerability it addresses.

Page generated 2015-08-21 16:49Z-07:00.