October 2015 Microsoft Patch Tuesday - SANS Internet Storm Center

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Handler on Duty: Didier Stevens

Threat Level: green

October 2015 Microsoft Patch Tuesday

Overview of the October 2015 Microsoft patches and their status.

#	Affected	Contra Indications - KB	Known Exploits	Microsoft rating(**)	ISC rating(*)
#	Affected	Contra Indications - KB	Known Exploits	Microsoft rating(**)	clients	servers
MS15-106	Cumulative Security Update for Internet Explorer (Replaces MS15-095)
MS15-106	Internet Explorer CVE-2015-2482 CVE-2015-6042 CVE-2015-6044 CVE-2015-6045 CVE-2015-6046 CVE-2015-6047 CVE-2015-6048 CVE-2015-6049 CVE-2015-6050 CVE-2015-6051 CVE-2015-6052 CVE-2015-6053 CVE-2015-6055 CVE-2015-6056 CVE-2015-6059	KB 3096441	None	Severity:Critical Exploitability: 1,1,4,1,2,1,1,1,4,1,2,4,1,1,2	Critical	Important
MS15-107	Cumulative Security Update for Microsoft Edge (Replaces MS15-094, MS15-095, MS15-097, MS15-098, MS15-101, MS15-102, MS15-105)
MS15-107	Microsoft Edge CVE-2015-6057 CVE-2015-6058	KB 3096448	None	Severity:Important Exploitability: 3,3	Important	Important
MS15-108	Remote Code Execution in JScript and VBScript (Replaces MS15-066)
MS15-108	JScript / VBScript Windows 2008 and Vista CVE-2015-2482 CVE-2015-6052 CVE-2015-6055 CVE-2015-6059	KB 3089659	.	Severity:Critical Exploitability: 4,4,4	Critical	Important
MS15-109	Remote Code Execution in Windows Shell (Replaces MS15-088, MS15-020)
MS15-109	Windows Shell CVE-2015-2525 CVE-2015-2548	KB 3096443	None	Severity:Critical Exploitability: 1,4	Critical	Important
MS15-110	Remote Code Execution in Microsoft Office (Replaces MS15-036, MS15-046, MS15-070, MS15-081, MS15-099)
MS15-110	Microsoft Office CVE-2015-2555 CVE-2015-2556 CVE-2015-2557 CVE-2015-2558 CVE-2015-6037 CVE-2015-6039	KB 3096440	None	Severity:Important Exploitability: 2,4,4,2,3,3	Critical	Important
MS15-111	Elevation of Privilege Vulnerability in Windows Kernel (Replaces MS15-025, MS15-038, MS15-052, MS15-076)
MS15-111	Windows Kernel CVE-2015-2549 CVE-2015-2550 CVE-2015-2552 CVE-2015-2553 CVE-2015-2554	KB 3096447	CVE-2015-2553 has been publicly disclosed.	Severity:Important Exploitability: 2,2,4,1,1	Important	Important

We will update issues on this page for about a week or so as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY

(*): ISC rating

We use 4 levels:
- PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
- Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
- Important: Things where more testing and other measures can help.
- Less Urt practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
- The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threatatches.

--
Alex Stanford - GIAC GWEB & GSEC,
Research Operations Manager,
SANS Internet Storm Center
/in/alexstanford

Alex Stanford

136 Posts

Oct 13th 2015

Thread locked Subscribe

Oct 13th 2015
6 years ago

In MS15-109, should CVE-2025-2548 be CVE-2015-2548?

Arthur

7 Posts

Quote

Oct 13th 2015
6 years ago

Quoting Arthur:In MS15-109, should CVE-2025-2548 be CVE-2015-2548?

Indeed, thank you for pointing that out!

Alex Stanford

136 Posts

Quote

Oct 13th 2015
6 years ago

MS15-109 list 2015-2525, I believe that is suppose to be 2015-2515

AnotherSecurityDud

1 Posts

Quote

Oct 13th 2015
6 years ago