Microsoft released a set of thirteen Security Bulletins (MS015-043 through MS015-055) to start off May 2015, addressing 46 vulnerabilities in a wide set of Microsoft software technologies. Three of these are rated critical for RCE and the rest of the May 2015 Security Bulletins are rated Important. Two of the critical Bulletins (043 and 044) are especially risky and address critical RCE vulnerabilities across all versions of supported Windows platforms.
Internet Explorer (MS015-043) critical
GDI+ drivers handling fonts (MS015-044) critical
Windows Journal (MS015-045) critical
Microsoft Office
Sharepoint Server
Silverlight
.NET Framework
JScript and VBScript Scripting Engines
MMC file format
Schannel (Microsoft’s network crypto libraries)
Most likely, your Windows systems are running at least a couple of those software packages, and will require a reboot after updating.
This round of IE memory corruption vulnerabilities enable remote code execution across all versions of the browser and supported Windows OS, IE6 – IE11. Even Internet Explorer 11 on Windows 8.1 maintains the flawed code, leading many to anticipate Microsoft’s new approach to web browser security in the upcoming Microsoft Edge: Building a safer browser.
Another issue enables RCE in Windows Journal, a note-taking application first written for XP Tablet associated with .jnt files. To disable the app, it seems that you can simply disable the “Tablet PC Options Components” Windows Feature on Vista or Windows 7, but you are without the Control Panel option on Windows 8.x. On Windows 8 and above systems, it looks like you can remove the .jnt file association in the registry, or, you can deny access to journal.exe with a couple of shell commands:
takeown.exe /f “%ProgramFiles%Windows JournalJournal.exe”
icacls.exe %ProgramFiles%Windows JournalJournal.exe” /deny everyone:(F)
And finally, another couple of font handling GDI+ vulnerabilities are patched, this time in the DirectWrite library handling for both OpenType (cve-2015-1670) and TrueType (cve-2015-1671) fonts. It’s 1671 that enables RCE on Windows systems running SilverLight, Lync, Live Meeting, Microsoft Office 2007 and 2010, supported .Net framework versions, and all the supported Windows operating system versions, including Windows 2008 and 2012 R2 Server Core. Depending on your OS, the patches can touch on a set of files, not just win32k.sys driver code:
Win32k.sys
Gdiplus.dll
D2d1.dll
Fntcache.dll
Dwrite.dll
D3d10level9.dll
D3d10_1.dll
D3d10_1core.dll
D3d10warp.dll
According to Microsoft, “When this security bulletin was issued, Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers”. Which may be mincing words, because Microsoft’s cve-2015-1671 vulnerability acknowledgement listed the Threat Research Manager at FireEye. That disclosure detail may add urgency to updating this vulnerability for some organizations.
Source: Kaspersky