Microsoft Security Bulletin MS16-012 - Critical

  • 5 minutes to read

Security Update for Microsoft Windows PDF Library to Address Remote Code Execution (3138938)

Published: February 9, 2016

Version: 1.0

Executive Summary

This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow remote code execution if Microsoft Windows PDF Library improperly handles application programming interface (API) calls, which could allow an attacker to run arbitrary code on the user’s system. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. However, an attacker would have no way to force users to download or open a malicious PDF document.

This security update is rated Critical for all supported editions of Windows 8.1, Windows Server 2012, Windows Server 2012 R2, and Windows 10. For more information, see the Affected Software section.

The update addresses the vulnerabilities by changing how memory is handled when API calls are made to the PDF Library, and by modifying how Windows Reader parses files. For more information about the vulnerabilities, see the Vulnerability Information section.

For more information about this update, see Microsoft Knowledge Base Article 3138938.

Affected Software and Vulnerability Severity Ratings

The following software versions or editions are affected. Versions or editions that are not listed are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see Microsoft Support Lifecycle.

The following severity ratings assume the potential maximum impact of the vulnerability. For information regarding the likelihood, within 30 days of this security bulletin's release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the February bulletin summary.

**Operating System** [**Microsoft PDF Library Buffer Overflow Vulnerability - CVE-2016-0058**](http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-0058) [**Microsoft Windows Reader Vulnerability - CVE-2016-0046**](http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-0046) **Updates Replaced**
**Windows 8.1**
[Windows 8.1 for 32-bit Systems](http://www.microsoft.com/downloads/details.aspx?familyid=e191962e-7f9d-47d8-88db-65ba9d1a6286) (3123294) **Critical**  Remote Code Execution **Critical**  Remote Code Execution None
[Windows 8.1 for x64-based Systems](http://www.microsoft.com/downloads/details.aspx?familyid=d470f055-8e7a-46ce-ad87-4ae65b2610b9) (3123294) **Critical**  Remote Code Execution **Critical**  Remote Code Execution None
**Windows Server 2012 and Windows Server 2012 R2**
[Windows Server 2012](http://www.microsoft.com/downloads/details.aspx?familyid=a4376aa7-43cb-4a3d-b10c-17934dac1d98) (3123294) **Critical**  Remote Code Execution **Critical**  Remote Code Execution None
[Windows Server 2012 R2](http://www.microsoft.com/downloads/details.aspx?familyid=7d6fad6f-8293-415f-aec4-2ef6610f4154) (3123294) **Critical**  Remote Code Execution **Critical**  Remote Code Execution None
**Windows 10**
[Windows 10 for 32-bit Systems](https://support.microsoft.com/kb/3135174)[1] (3135174) **Critical**  Remote Code Execution **Critical**  Remote Code Execution None
[Windows 10 for x64-based Systems](https://support.microsoft.com/kb/3135174)[1] (3135174) **Critical**  Remote Code Execution **Critical**  Remote Code Execution None
**Server Core installation option**
[Windows Server 2012 R2](http://www.microsoft.com/downloads/details.aspx?familyid=7d6fad6f-8293-415f-aec4-2ef6610f4154) (Server Core installation) (3123294) **Critical**  Remote Code Execution **Critical**  Remote Code Execution None
[1]Windows 10 updates are cumulative. In addition to containing non-security updates, they also contain all of the security fixes for all of the Windows 10-affected vulnerabilities shipping with the monthly security release. The update is available via the [Windows Update Catalog](http://catalog.update.microsoft.com/v7/site/home.aspx).

Vulnerability Information

Microsoft Windows Reader Vulnerability - CVE-2016-0046

A remote code execution vulnerability exists in Microsoft Windows when a specially crafted file is opened in Windows Reader. An attacker who successfully exploited this vulnerability could cause arbitrary code to execute in the context of the current user. If a user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

For an attack to succeed, a user must open a specially crafted Windows Reader file with an affected version of Windows Reader. In an email attack scenario, an attacker would have to convince the user to open a specially crafted Windows Reader file. The update addresses the vulnerability by modifying how Windows Reader parses files.

The following table contains links to the standard entry for each vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability title CVE number Publicly disclosed Exploited
Microsoft Windows Reader Vulnerability CVE-2016-0046 No No
### Mitigating Factors Microsoft has not identified any [mitigating factors](https://technet.microsoft.com/library/security/dn848375.aspx) for this vulnerability. ### Workarounds Microsoft has not identified any [workarounds](https://technet.microsoft.com/library/security/dn848375.aspx) for this vulnerability. Microsoft PDF Library Buffer Overflow Vulnerability - CVE-2016-0058 ------------------------------------------------------------------- A vulnerability exists in Microsoft Windows PDF Library when it improperly handles application programming interface (API) calls, which could allow an attacker to run arbitrary code on the user’s system. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. An attacker would have no way to force a user to download or run malicious code in a PDF document. The update addresses the vulnerability by changing how memory is handled for API calls to the PDF Library. The following table contains links to the standard entry for each vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability title CVE number Publicly disclosed Exploited
Microsoft PDF Library Buffer Overflow Vulnerability CVE-2016-0058 No No
### Mitigating Factors Microsoft has not identified any [mitigating factors](https://technet.microsoft.com/library/security/dn848375.aspx) for this vulnerability. ### Workarounds Microsoft has not identified any [workarounds](https://technet.microsoft.com/library/security/dn848375.aspx) for this vulnerability. Security Update Deployment -------------------------- For Security Update Deployment information, see the Microsoft Knowledge Base article referenced [here](#kbarticle) in the Executive Summary. Acknowledgments --------------- Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure. See [Acknowledgments](https://technet.microsoft.com/library/security/mt674627.aspx) for more information. Disclaimer ---------- The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. Revisions --------- - V1.0 (February 9, 2016): Bulletin published. *Page generated 2016-02-09 08:26-08:00.*