Microsoft Patch Tuesday Summary for June 2015

Published: 2015-06-09
Last Updated: 2015-06-09 18:12:40 UTC
by Johannes Ullrich (Version: 1)
3 comment(s)

Overview of the June 2015 Microsoft Patches and their status.

# Affected Contra Indications - KB Known Exploits Microsoft rating(**) ISC rating(*)
clients servers
MS15-056 Cumulative Security Update for Internet Explorer (Replaces MS15-043 )
Internet Explorer
CVE-2015-1687
CVE-2015-1730
CVE-2015-1731
CVE-2015-1732
CVE-2015-1735
CVE-2015-1736
CVE-2015-1737
CVE-2015-1739
CVE-2015-1740
CVE-2015-1741
CVE-2015-1742
CVE-2015-1743
CVE-2015-1744
CVE-2015-1745
CVE-2015-1747
CVE-2015-1748
CVE-2015-1750
CVE-2015-1751
CVE-2015-1752
CVE-2015-1753
CVE-2015-1754
CVE-2015-1755
CVE-2015-1765
CVE-2015-1766
KB 3058515 CVE-2015-1765 publicly disclosed. Severity:Critical
Exploitability: 1
Critical Important
MS15-057 Remote Code Execution Vulnerability in Windows Media Player (Replaces MS10-082 )
Windows Media Player
CVE-2015-1728
KB 3033890 no. Severity:Critical
Exploitability: 2
Critical Important
MS15-058 No Bulletin Published for MS15-058
MS15-059 Remote Code Execution Vulnerabilities in Microsoft Office (Replaces MS13-091 )
Microsoft Office
CVE-2015-1759
CVE-2015-1760
CVE-2015-1770
KB 3064949 no. Severity:Important
Exploitability: 1
Critical Important
MS15-060 Remote Code Execution Vulnerability in Microsoft Common Controls (Replaces MS15-043 )
Windows Common Controls (IE Developer Tools)
CVE-2015-1756
KB 3059317 publicly disclosed. Severity:Important
Exploitability: 2
Important Important
MS15-061 Privilege Elevation Vulnerability in Windows Kernel-Mode Drivers (Replaces MS15-023 )
Kernel-Mode Drivers
CVE-2015-1719
CVE-2015-1720
CVE-2015-1721
CVE-2015-1722
CVE-2015-1723
KB 3057839 no. Severity:Important
Exploitability: 1
Important Important
MS15-062 XSS Vulnerablity in Active Directory Federation Services (Replaces MS14-077 )
Active Directory Federation Services
CVE-2015-1757
KB 3062577 no, but looks like bulletin includes a PoC. Severity:Important
Exploitability: 2
N/A Important
MS15-063 Elevation of Privilege Vulnerability in Windows Kernel (Replaces MS14-019 )
Windows Kernel
CVE-2015-1758
KB 3063858 no. Severity:Important
Exploitability: 2
Important Important
MS15-064 Elevation of Privilege Vulnerabilities in Microsoft Exchange
Microsoft Exchange Web Applications
CVE-2015-1764
CVE-2015-1771
CVE-2015-2359
KB 3062157 no. Severity:Important
Exploitability: 2
N/A Important
We will update issues on this page for about a week or so as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
(*): ISC rating
  • We use 4 levels:
    • PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
    • Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
    • Important: Things where more testing and other measures can help.
    • Less Urt practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
    • The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threat.

---
Johannes B. Ullrich, Ph.D.
STI|Twitter|LinkedIn

Keywords: mspatchday
3 comment(s)

Comments

Note that MS15-056 includes "non security enhancements".

One of this, which is very security relevant is HSTS for IE11 on Windows 7, 8.1, and 2012. This is using the Chromium Preload Set as Chrome and Firefox are doing. HSTS is enabled by default, but can be disabled through a registry setting. HSTS is a good feature, however if people have a problem, it is better to disable HSTS than roll back the whole patch.

https://support.microsoft.com/en-us/kb/3071338
Microsoft's website has MS15-061, CVE-2015-2360 listed as Exploitability:0, exploitation detected in the table https://technet.microsoft.com/library/security/ms15-JUN.
It is listed as publicly exposed: no, exploited: yes on https://technet.microsoft.com/library/security/MS15-061.
This is not directly related to Microsoft Patch Tuesday. but it is indirectly. I'm trying to implement the patch management practice, but I'm struggling with operationalizing it with IT.
Is there a practical "best practice" guide for patch management? I know NIST has one (800-40), but I'm looking for a practical guide, not just for Microsoft, but other patching (e.g. Adobe, Apache, Oracle, Cisco) as well. I've looked thru your archives and haven't found one.

Thanks and keep up the good work!

Diary Archives