Microsoft Security Bulletin MS15-067 - Critical
Vulnerability in RDP Could Allow Remote Code Execution (3073094)
Published: July 14, 2015 | Updated: August 21, 2015
Version: 1.1
Executive Summary
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if an attacker sends a specially crafted sequence of packets to a targeted system with the Remote Desktop Protocol (RDP) server service enabled. By default, the RDP server service is not enabled on any Windows operating system. Systems that do not have the RDP server service enabled are not at risk.
This security update is rated Critical for affected editions of Windows 7, Windows 8, and Windows Server 2012. For more information, see the Affected Software section.
The security update addresses the vulnerability by modifying how the terminal service handles packets. For more information about the vulnerability, see the Vulnerability Information section.
For more information about this update, see Microsoft Knowledge Base Article 3073094.
Affected Software
The following software versions or editions are affected. Versions or editions that are not listed are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see Microsoft Support Lifecycle.
| Operating System | Maximum Security Impact | Aggregate Severity Rating | Updates Replaced* |
|---|---|---|---|
| Windows 7 | |||
| Windows 7 for 32-bit Systems Service Pack 1 (3067904) | Remote Code Execution | Critical | 3035017 in MS15-030 |
| Windows 7 for 32-bit Systems Service Pack 1** (**3069762)[1] | Remote Code Execution | Critical | 3036493 in MS15-030 |
| Windows 7 for x64-based Systems Service Pack 1 (3067904) | Remote Code Execution | Critical | 3035017 in MS15-030 |
| Windows 7 for x64-based Systems Service Pack 1 (3069762)[1] | Remote Code Execution | Critical | 3036493 in MS15-030 |
| Windows 8 | |||
| Windows 8 for 32-bit Systems (3067904) | Remote Code Execution | Critical | 2965788 and 3035017 in MS15-030 |
| Windows 8 for x64-based Systems (3067904) | Remote Code Execution | Critical | 2965788 and 3035017 in MS15-030 |
| Windows Server 2012 | |||
| Windows Server 2012 (3067904) | Remote Code Execution | Critical | 2965788 and 3035017 in MS15-030 |
| Server Core installation option | |||
| Windows Server 2012 (Server Core installation) (3067904) | Remote Code Execution | Critical | 2965788 and 3035017 in MS15-030 |
[1]Customers running RDP 8.0 on supported editions of Windows 7 need only install update 3069762. See the Update FAQ for more information.
*The Updates Replaced column shows only the latest update in a chain of superseded updates. For a comprehensive list of updates replaced, go to the Microsoft Update Catalog, search for the update KB number, and then view update details (updates replaced information is on the Package Details tab).
Update FAQ
I am running Windows 7. Why am I not being offered both updates listed in the Affected Software table for Windows 7?
The update you need to install depends on which version of RDP you have installed on your computer:
- If you do not have any version of RDP installed, you need only install update 3067904 to be fully protected from the vulnerabilities described in this bulletin.
- If you have RDP 8.0 installed, you need only install update 3069762 to be fully protected from the vulnerabilities described in this bulletin.
For more information about RDP 8.0, see Microsoft Knowledge Base Article 2592687.
Severity Ratings and Vulnerability Identifiers
The following severity ratings assume the potential maximum impact of the vulnerability. For information regarding the likelihood, within 30 days of this security bulletin's release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the July bulletin summary.
| Vulnerability Severity Rating and Maximum Security Impact by Affected Software | ||
|---|---|---|
| Affected Software | Remote Desktop Protocol (RDP) Remote Code Execution Vulnerability - CVE-2015-2373 | Aggregate Severity Rating |
| Windows 7 | ||
| Windows 7 for 32-bit Systems Service Pack 1 (3067904) | Critical Remote Code Execution | Critical |
| Windows 7 for 32-bit Systems Service Pack 1 (3069762) | Critical Remote Code Execution | Critical |
| Windows 7 for x64-based Systems Service Pack 1 (3067904) | Critical Remote Code Execution | Critical |
| Windows 7 for x64-based Systems Service Pack 1 (3069762) | Critical Remote Code Execution | Critical |
| Windows 8 | ||
| Windows 8 for 32-bit Systems (3067904) | Critical Remote Code Execution | Critical |
| Windows 8 for x64-based Systems (3067904) | Critical Remote Code Execution | Critical |
| Windows Server 2012 | ||
| Windows Server 2012 (3067904) | Critical Remote Code Execution | Critical |
| Server Core installation option | ||
| Windows Server 2012 (Server Core installation) (3067904) | Critical Remote Code Execution | Critical |
Vulnerability Information
Remote Desktop Protocol (RDP) Remote Code Execution Vulnerability - CVE-2015-2373
A remote code execution vulnerability exists in how the Remote Desktop Protocol (RDP) (terminal) service handles packets. While the most likely outcome of this vulnerability is denial of the remote desktop (terminal) service (DOS), remote code execution is possible.
To exploit the vulnerability, an attacker could send a specially crafted sequence of packets to a system running the RDP server service. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The update addresses the vulnerability by modifying how the terminal service handles packets.
Microsoft received information about this vulnerability through coordinated vulnerability disclosure. When this security bulletin was issued, Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers.
Mitigating Factors
Microsoft has not identified any mitigating factors for this vulnerability.
Workarounds
Microsoft has not identified any workarounds for this vulnerability.
Security Update Deployment
For Security Update Deployment information, see the Microsoft Knowledge Base article referenced in the Executive Summary.
Acknowledgments
Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure. See Acknowledgments for more information.
Disclaimer
The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Revisions
- V1.0 (July 14, 2015): Bulletin published.
- V1.1 (August 21, 2015): Improved the Update FAQ section and the footnote for the Affected Software table to help customers more easily identify the correct update to apply based on the currently installed version of RDP on Windows 7 systems. These are informational changes only. Customers who have already successfully applied the update do not need to take any action. Customers who have not already installed the necessary update should do so to be protected from the vulnerability it addresses.
Page generated 2015-08-21 16:49Z-07:00.