Monthly Security Bulletin Briefing July 2015. Security Advisory Revision Other content Product Support Lifecycle Appendix Manageability Tools Reference.

Monthly Security Bulletin Briefing

July 2015

Security Advisory Revision Other content• Product Support

Lifecycle

Appendix• Manageability

Tools Reference• Related

Resources

New

Critical

Important

1046

July 2015Security Bulletin Release

Security Bulletins

New

Critical

Important

144

10

New2 Bulletin

Advisory

00

Slide 2

July 2015 Security Bulletin Release Overview

Bulletin Impact Component Severity Exploit Index Disclosure Exploited?

MS15-058 Remote Code Execution SQL Important 2 Private No

MS15-065 Remote Code Execution IE Critical 0 Public Yes

MS15-066 Remote Code Execution VBScript Critical 1 Private No

MS15-067 Remote Code Execution RDP Critical 3 Private No

MS15-068 Remote Code Execution Hyper-V Critical 2 Private No

MS15-069 Remote Code Execution Windows Important 1 Private No

MS15-070 Remote Code Execution Office Important 0 Private Yes

MS15-071 Elevation of Privilege Netlogon Important 3 Private No

MS15-072 Elevation of Privilege Graphics Comp Important 1 Private No

MS15-073 Elevation of Privilege KMD Important 1 Private No

MS15-074 Elevation of Privilege Windows Installer Important 1 Private No

MS15-075 Elevation of Privilege OLE Important 1 Private No

MS15-076 Elevation of Privilege RPC Important 2 Private No

MS15-077 Elevation of Privilege ATM Font Driver Important 0 Public Yes

Exploitability Index: 0 – Exploitation Detected | 1 - Exploitation more likely | 2 – Exploitation less likely | 3 – Exploitation unlikely | NA - Not Affected

Slide 3

MS15-058 Vulnerabilities in SQL Server Could Allow Remote Code Execution (3065718)

Affected software

Executive Summary

More Information

This security update resolves vulnerabilities in Microsoft SQL Server. The most severe vulnerabilities could allow remote code execution if an authenticated attacker runs a specially crafted query that is designed to execute a virtual function from a wrong address, leading to a function call to uninitialized memory. To exploit this vulnerability an attacker would need permissions to create or modify a database. The security update addresses the vulnerabilities by correcting how SQL Server handles internal function calls and pointer casting.

Microsoft SQL Server 2008, SQL Server 2008 R2, SQL Server 2012. SQL Server 2014

Different update files exist depending on which servicing branch a particular system is on. Check the bulletin FAQ for a table of product versions.

Severity

IMPORTANT

Impact

RCE

Exploitability Index

2

Disclosure

NO

Slide 4

CVE-2015-1761 — Attacker needs permissions to create or modify a database.

CVE-2015-1762 — Attacker must have special permissions and transactional replication must be enabled.

CVE-2015-1761/1763 — Limit permissions on server for database and schema creation.

CVE-2015-1762 — no workarounds

Mitigations Workarounds

Authenticated attacker with special permissions accesses a database or runs a specially crafted query against an affected SQL server.

Attack Vectors

MS15-058 Vulnerabilities in SQL Server Could Allow Remote Code Execution (3065718)


CVE Severity Impact XI Latest XI Legacy XI DOS Public Exploited Advisory

CVE-2015-1762 ImportantRemote Code

Execution3 3 NA No No No



CVE-2015-1761 Important Elevation of Privilege 2 2 NA No No No

Slide 5

MS15-065 Security Update for Internet Explorer (3076321)

Affected software

Executive Summary

More Information

This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user. The security update addresses the vulnerabilities by modifying the way that IE handles objects in memory, adding additional permission validations to IE, helping to ensure that affected versions of JScript and VBScript and IE properly implement the ASLR security feature, and helping to prevent information stored in a user’s clipboard from being accessed by a malicious site.

All supported versions of Internet Explorer on all supported versions of Windows

There are multiple update packages bundled with this update that get installed transparently under most deployment scenarios. When deploying updates manually, be sure to install in correct order. ..

Severity

CRITICAL

Impact

RCE


0

Disclosure

YES

Slide 6


CVE-2015-2425 CriticalRemote Code

Execution0 0 NA Yes Yes No

Multiple CriticalRemote Code



ExecutionNA 1 NA No No No


Execution1 1 NA Yes No No


Multiple Important Information Disclosure 1 1 NA No No No

CVE-2015-2398 ImportantSecurity Feature

Bypass2 2 NA Yes No No


Bypass2 2 NA No No No

Attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by getting them to open an attachment sent through email. No way for attacker to force user to view malicious content.

All memory corruption CVE — Exploitation only gains the same user rights as the logged-on account.

All memory corruption CVE — EMET helps mitigate the attacks.

All memory corruption CVE — By default, IE runs in Enhanced Security Configuration mode for all Windows Servers.

CVE-2015-2372 — restrict access to vbscript.dll. See bulletin for details.


Attacker hosts a malicious website utilizing the vulnerability, then convinces users to visit the site.

Attacker takes advantage of compromised websites and/or sites hosting ads from other providers.

Attack Vectors

MS15-065 Security Update for Internet Explorer (3076321)


Slide 7

MS15-066 Vulnerability in VBScript Scripting Engines Could Allow Remote Code Execution (3072604)

Affected software

Executive Summary

More Information

This security update resolves a vulnerability in the VBScript scripting engine in Microsoft Windows. The vulnerability could allow remote code execution if a user visits a specially crafted website. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The security update addresses the vulnerability by modifying how the VBScript scripting engine handles objects in memory.

Windows Vista, Windows Server 2003, Windows Server 2008

The updates available in this bulletin are for systems without Internet Explorer installed or for systems with Internet Explorer 8 or earlier versions installed. For IE 9 and later, apply MS15-065.

Severity

CRITICAL

Impact

RCE


1

Disclosure

NO

Slide 8




Microsoft has not identified any mitigating factors for this vulnerability.

CVE-2015-2372 — restrict access to VBScript.dll. See bulletin for details.


Attacker hosts a malicious website utilizing the vulnerability, then convinces users to visit the site.

Attacker takes advantage of compromised websites and/or sites hosting ads from other providers.

Attacker could embed an ActiveX control marked “safe for initialization” in an application or Microsoft Office document that hosts the IE rendering engine.

Attack Vectors

MS15-066 Vulnerabilities in VBScript Scripting Engines Could Allow Remote Code Execution (3072604)


Slide 9

MS15-067 Vulnerability in RDP Could Allow Remote Code Execution (3073094)

Affected software

Executive Summary

More Information

This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if an attacker sends a specially crafted sequence of packets to a targeted system with Remote Desktop Protocol (RDP) server service enabled. By default, the RDP server service is not enabled on any Windows operating system. Systems that do not have the RDP server service enabled are not at risk. The security update addresses the vulnerability by modifying how the terminal service handles packets.

Windows 7, Windows 8, Windows Server 2012

Enterprise and Ultimate editions of Windows 7 are affected. All supported editions of Windows 7 are affected if RDP 8.0 is installed on the system. For customers running RDP 8.0 on local systems who do not need the new server-side features provided in RDP 8.0, Microsoft recommends upgrading to RDP 8.1 and not applying (or removing) the 3067904 update.

Severity

CRITICAL

Impact

RCE


3

Disclosure

NO

Slide 10



ExecutionNA 3 P No No No


Microsoft has not identified any workarounds for this vulnerability.


Attacker sends a specially crafted sequence of packets to a system running RDP server service.

Attack Vectors

MS15-067 Vulnerability in RDP Could Allow Remote Code Execution (3073094)


Slide 11

MS15-068 Vulnerabilities in Windows Server Hyper-V Could Allow Remote Code Execution (3072000)

Affected software

Executive Summary

More Information

This security update resolves vulnerabilities in Windows Server Hyper-V. The vulnerabilities could allow remote code execution in a host context if a specially crafted application is run by an authenticated and privileged user on a guest virtual machine hosted by Hyper-V. An attacker must have valid logon credentials for a guest virtual machine to exploit this vulnerability. The security update addresses the vulnerabilities by correcting how Hyper-V initializes system data structures in guest virtual machines.

Windows 8 x64, Windows 8.1 x64, Windows Server 2008 x64, Windows Server 2008 R2 x64, Windows Server 2012

None.

Severity

CRITICAL

Impact

RCE


2

Disclosure

NO

Slide 12



Execution2 2 P No No No

CVE-2015-2362 Critical Remote Code


Attacker must have valid logon credentials on a guest virtual machine.

Microsoft has not identified any workarounds for these vulnerabilities.


A specially crafted application is run by an authenticated and privileged user on a guest virtual machine hosted by Hyper-V.

Attack Vectors

MS15-068 Vulnerabilities in Windows Server Hyper-V Could Allow Remote Code Execution (3072000)


Slide 13

MS15-069 Vulnerabilities in Windows Could Allow Remote Code Execution (3072631)

Affected software

Executive Summary

More Information

This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow Remote Code Execution if an attacker first places a specially crafted dynamic link library (DLL) file in the target user’s current working directory and then convinces the user to open an RTF file or to launch a program that is designed to load a trusted DLL file but instead loads the attacker’s specially crafted DLL file. An attacker who successfully exploited the vulnerabilities could take complete control of an affected system.Windows Vista, Windows 7, Windows 8.1, Windows RT 8.1, Windows Server 2003 x86 and x64, Windows Server 2008 x86 and x64, Windows Server 2008 R2 x86 and x64, Windows Server 2012 R2

Windows Server 2008 R2 systems are affected only if Desktop Experience is installed.

Severity

IMPORTANT

Impact

RCE


1

Disclosure

NO

Slide 14






Microsoft has not identified any mitigating factors for these vulnerabilities.

CVE-2015-2369 — Modify the registry to prevent Office documents from loading the WMDMCESP. WMDMCESP ActiveX control. See bulletin for details.


Attacker places a specially crafted DLL file in the target user’s current working directory and then convinces the user to open a specially crafted .RTF file or launch a program that loads a trusted DLL file but instead loads the attacker’s specially crafted DLL file.

Attack Vectors

MS15-069 Vulnerabilities in Windows Could Allow Remote Code Execution (3072631)


Slide 15

MS15-070 Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3072620)

Affected software

Executive Summary

More Information

This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. The security update addresses the vulnerabilities by correcting how correcting how Office parses specially crafted files, handles files in memory, and by helping to ensure the SharePoint Server properly sanitizes user input.

Office 2007, Office 2010, Office 2013, Office 2013 RT, Office for Mac, Excel Viewer 2007, Office Compatibility Pack, Word Viewer, Excel Services on SharePoint Server 2007, 2010, 2013

There are many different updates associated with this bulletin due to the number of affected Office products. Depending on configuration, more than one update may be applicable to your environment.

Severity

IMPORTANT

Impact

RCE


0

Disclosure

NO

Slide 16



Execution0 0 NA No Yes No



Multiple ImportantRemote Code



Bypass2 2 NA No No No

All CVE except CVE-2015-2378 — Attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by getting them to open an attachment sent through email. No way for attacker to force user to view malicious content.

Exploitation only gains the same user rights as the logged-on account.



Exploitation of these vulnerabilities requires that a user open a specially crafted file with an affected version of Microsoft Office software.

Web Scenario - Attacker hosts a malicious website utilizing the vulnerability, then convinces users to visit the site or attacker takes advantage of compromised websites and/or sites hosting ads from other providers.

Email scenario - Attacker sends specially–crafted file and persuades user to open file.

CVE-2015-2378 — Attacker places a specially crafted DLL file in the target user’s current working directory and then convinces the user to launch a program that loads a trusted DLL file but instead loads the attacker’s specially crafted DLL file.

Attack Vectors

MS15-070 Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3072620)


Slide 17

MS15-071 Vulnerability in NETLOGON Could Allow Elevation of Privilege (3068457)

Affected software

Executive Summary

More Information

This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker with access to a primary domain controller (PDC) on a target network runs a specially crafted application to establish a secure channel to the PDC as a backup domain controller (BDC). The update addresses the vulnerability by modifying how Netlogon handles establishing secure channels.

Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012 , Windows Server 2012 R2

None.

Severity

IMPORTANT

Impact

EOP


3

Disclosure

NO

Slide 18






An elevation of privilege vulnerability exists in Netlogon that is caused when the service improperly establishes a secure communications channel to a primary domain controller (PDC). An attacker would first need to have access to a PDC on a target network. An attacker could then run a specially crafted application that could establish a secure channel to the PDC as a backup domain controller (BDC) and may be able to disclose credentials.

Attack Vectors

MS15-071 Vulnerability in NETLOGON Could Allow Elevation of Privilege (3068457)


Slide 19

MS15-072 Vulnerability in Windows Graphics Component Could Allow Elevation of Privilege (3069392)

Affected software

Executive Summary

More Information

The vulnerability could allow elevation of privilege if Windows Graphics component fails to properly process bitmap conversions. An authenticated attacker who successfully exploited this vulnerability could elevate privileges on a targeted system. The security update addresses the vulnerability by correcting how Windows processes bitmap conversions.

Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows RT, Windows RT 8.1, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012 , Windows Server 2012 R2

None.

Severity

IMPORTANT

Impact

EOP


1

Disclosure

NO

Slide 20


CVE-2015-2364 Important Elevation of Privilege 1 NA NA No No No

Attacker must be able to log on to system to exploit.



To exploit the vulnerability, an attacker must first log on to the system. An attacker could then run a specially crafted application designed to increase privileges.

Attack Vectors

MS15-072 Vulnerability in Windows Graphics Component Could Allow Elevation of Privilege (3069392)


Slide 21

MS15-073 Vulnerabilities in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (3070102)

Affected software

Executive Summary

More Information

The most severe of these vulnerabilities could allow elevation of privilege if an attacker logs on to the system and runs a specially crafted application. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerabilities by correcting how the Windows kernel-mode driver handles objects in memory.


None.

Severity

IMPORTANT

Impact

EOP


1

Disclosure

NO

Slide 22


CVE-2015-2363 Important Elevation of Privilege 1 1 P No No No

CVE-2015-2365 Important Elevation of Privilege 1 1 P No No No


CVE-2015-2367 Important Information Disclosure 2 2 NA No No No



An attacker must have valid logon credentials and be able to log on locally to exploit these vulnerabilities.



Attacker logs on to system and runs a specially crafted application.

Attack Vectors

MS15-073 Vulnerabilities in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (3070102)


Slide 23

MS15-074 Vulnerability in Windows Installer Component Could Allow Elevation of Privilege (3072630)

Affected software

Executive Summary

More Information

The vulnerability could allow elevation of privilege if the Windows Installer component improperly runs custom action scripts. An authenticated attacker who successfully exploited this vulnerability could elevate privileges on a targeted system. The security update addresses the vulnerability by correcting how custom action scripts are executed.


None.

Severity

IMPORTANT

Impact

EOP


1

Disclosure

NO

Slide 24






To exploit the vulnerability, an attacker must first compromise a user who is logged on to the target system, then find a vulnerable .msi package that is installed on the target system and, finally, place specially crafted code on the target system that the vulnerable .msi package can execute.

Attack Vectors

MS15-074 Vulnerability in Windows Installer Component Could Allow Elevation of Privilege (3072630)


Slide 25

MS15-075 Vulnerabilities in OLE Could Allow Elevation of Privilege (3072633)

Affected software

Executive Summary

More Information

The vulnerabilities could allow elevation of privilege if an attacker convinces a user to open a file that contains a specially crafted OLE component. The security update addresses the vulnerability by modifying how OLE objects are handled in memory.


None

Severity

IMPORTANT

Impact

EOP


1

Disclosure

NO

Slide 26


CVE-2015-2416 Important Elevation of Privilege 1 NA NA No No No


Attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an Instant Messenger message that takes users to the attacker's website (or network share), or by getting them to open an attachment sent through email. No way for attacker to force user to view malicious content.



An attacker could exploit the vulnerabilities by convincing a user to open a file that contains a specially crafted OLE object.

Attack Vectors

MS15-075 Vulnerabilities in OLE Could Allow Elevation of Privilege (3072633)


Slide 27

MS15-076 Vulnerability in Windows Remote Procedure Call Could Allow Elevation of Privilege (3067505)

Affected software

Executive Summary

More Information

The vulnerability, which exists in Windows Remote Procedure Call (RPC) authentication, could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application. An attacker who successfully exploited this vulnerability could take complete control of the affected system. The security update addresses the vulnerability by improving how Windows Remote Procedure Call (RPC) handles authentication checks to preclude redirection.Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows RT, Windows RT 8.1, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012 , Windows Server 2012 R2

None.

Severity

IMPORTANT

Impact

EOP


2

Disclosure

NO

Slide 28






To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application designed to elevate privileges.

Attack Vectors

MS15-076 Vulnerability in Windows Remote Procedure Call Could Allow Elevation of Privilege (3067505)


Slide 29

MS15-077 Vulnerability in ATM Font Driver Could Allow Elevation of Privilege (3077657)

Affected software

Executive Summary

More Information

The vulnerability Adobe Type Manager Font Driver (ATMFD) could allow elevation of privilege if an attacker logs on to a target system and runs a specially crafted application. An attacker who successfully exploited this vulnerability could execute arbitrary code and take complete control of an affected system. The security update addresses the vulnerability by correcting how ATMFD handles objects in memory.


US Cert vulnerability note : http://www.kb.cert.org/vuls/id/103336

Severity

IMPORTANT

Impact

EOP


0

Disclosure

YES

Slide 30

http://www.kb.cert.org/vuls/id/103336




CVE-2015-2387 Important Elevation of Privilege 0 0 NA Yes Yes No


Rename ATMFD.DLL. See bulletin for details.

Impact: applications relying on embedded font technology will not display properly.


To exploit the vulnerability, an attacker would first have to log on to a target system and then run a specially crafted application.

Attack Vectors

MS15-077 Vulnerability in ATM Font Driver Could Allow Elevation of Privilege (3077657)


Slide 31

Executive Summary

This update provides enhanced protection where DES is still used for application compatibility reasons. After applying the update, DES is disabled for the following built-in accounts: krbtgt, trust, machine, machine/user accounts.

Suggested Actions

Microsoft recommends that customers running applications that may still use DES encryption to test this update carefully and then deploy.

More Information

https://support.microsoft.com/kb/3057154

DES Hardening

Test and Deploy

KB

Security Advisory – Update to Harden Use of DES Encryption SA3057154

Slide 32


Executive Summary

An update to the Microsoft Malicious Software Removal Tool (MSRT) is available that addresses a security vulnerability that could allow elevation of privilege if an attacker logs on to a target system and places a specially crafted dynamic link library (.dll) file in a local directory. An authenticated attacker who successfully exploited the vulnerability could elevate privileges on a target system.

Suggested Actions

Typically, no action is required of enterprise administrators or end users to install updates for the Microsoft Malicious Software Removal Tool, because the built-in mechanism for the automatic detection and deployment of updates will apply the update within 48 hours of release. Administrators may need to ensure that the latest version of the MSRT is approved for deployment.

More Information

Last version of the MSRT affected by this vulnerability: Version 5.25.

First version of the MSRT with this vulnerability addressed: Version 5.26


CVE-2015-2418 EoP

Update Immediately

KB

Security Advisory – Vulnerability in Microsoft Malicious Software Removal Tool Could Allow Elevation of Privilege SA3074162

Slide 33



• Microsoft Windows Server 2003• Microsoft Forefront Client SecurityProduct Families

• Microsoft Dynamics GP 2013 (RTM)• Microsoft SQL Server 2012 Service Pack 1Service Packs

Public migration planning assistant:• http://www.microsoft.com/en-us/server-cloud/products/windows-se

rver-2003/#fbid=dOMveZ3Cgwj

More Information

Product Families and Service Packs Reaching End of Support

Slide 34

http://www.microsoft.com/en-us/server-cloud/products/windows-server-2003/#fbid=dOMveZ3Cgwj



Appendix

Detection and Deployment

Bulletin Component Windows Update Microsoft Update MBSA WSUS 3.0 Configuration Manager

MS15-058 SQL Server No Yes Yes Yes Yes

MS15-065 Internet Explorer Yes Yes Yes1 Yes1 Yes1

MS15-066 VBScript Yes Yes Yes1 Yes1 Yes1

MS15-067 RDP Yes Yes Yes1 Yes1 Yes1

MS15-068 Hyper-V Yes Yes Yes Yes Yes

MS15-069 Windows Yes Yes Yes1 Yes1 Yes1

MS15-070 Office No Yes Yes1 Yes1 Yes1

MS15-071 Netlogon Yes Yes Yes Yes Yes

MS15-072Graphics Component

Yes Yes Yes1 Yes1 Yes1

MS15-073 Kernel Mode Drivers Yes Yes Yes1 Yes1 Yes1

MS15-074 MSI Yes Yes Yes1 Yes1 Yes1

MS15-075 OLE Yes Yes Yes1 Yes1 Yes1

MS15-076 RPC Yes Yes Yes1 Yes1 Yes1

MS15-077 ATM Font Driver Yes Yes Yes1 Yes1 Yes1

1. Windows RT systems only support detection and deployment from Windows Update, Microsoft Update and the Windows Store

Slide 36

Additional Update Information

Bulletin Component Restart Uninstall Replaces

MS15-058 SQL Server Maybe Yes None

MS15-065 Internet Explorer Yes Yes MS15-056

MS15-066 VBScript Maybe Yes MS15-019

MS15-067 RDP Maybe Yes MS15-030

MS15-068 Hyper-V Yes Yes None

MS15-069 Windows Maybe Yes None

MS15-070 Office Maybe Yes (except SharePoint, Mac) MS13-084, MS15-022, MS15-033, MS15-046

MS15-071 Netlogon Yes Yes MS15-027

MS15-072 Graphics Component Yes Yes MS14-036, MS15-035

MS15-073 Kernel Mode Drivers Yes Yes MS15-061

MS15-074 MSI Yes Yes MS14-049

MS15-075 OLE Maybe Yes MS13-070

MS15-076 RPC Yes Yes MS15-031, MS15-052, MS15-055

MS15-077 ATM Font Driver Yes Yes MS15-021

1. Windows RT systems only support detection and deployment from Windows Update, Microsoft Update and the Windows Store

Slide 37

Antimalware Resources

Malicious Software Removal Tool

Win32/Crowti – This ransomware encrypts the files on your PC and directs

you to a webpage with instructions on how to unlock them.

Win32/Reveton – This ransomware locks your PC and displays a full-screen

message, commonly called a "lock screen”.

Additional Malware removal tools

Microsoft Safety Scanner

Same basic engine as the MSRT, but with a full set of A/V signatures.

Windows Defender Offline

An offline bootable A/V tool with a full set of signatures.

Designed to remove rootkits and other advanced malware that can't always be detected by antimalware programs.

Requires you to download an ISO file and burn a CD, DVD, or USB flash drive.

Slide 38

Public Security Bulletin Resource Links

Microsoft Security Bulletin Summary for July 2015• https://technet.microsoft.com/library/ms15-jul.aspx

Security Bulletin Search• http://technet.microsoft.com/security/bulletin

Security Advisories• http://technet.microsoft.com/security/advisory

Microsoft Technical Security Notifications• http://technet.microsoft.com/security/dd252948.aspx

Detailed Bulletin Information Spreadsheet• http://go.microsoft.com/fwlink/?LinkID=245778

Security Tools for IT Pros• http://technet.microsoft.com/en-us/security/cc297183

KB894199 Description of Software Update Services and Windows Server Update Services changes in content• http://support.microsoft.com/kb/894199

The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software• http://support.microsoft.com/kb/890830

Slide 39

Known IssuesMS15-058 SQL

KB3045317 - MS15-058: Description of the security update for SQL Server 2012 SP1 QFE: July 14, 2015

• An instance of SQL Server 2012 Service Pack 1 that has the Master Data Services (MDS) component installed but does not have the SQL Engine component installed may not discover this security update from Microsoft Update.

KB3045313, KB3045314, KB3045316 - MS15-058: Description of the security update for SQL Server 2008 R2 (SP2 & SP3)

• When you use the /? switch or the /Help switch with this security update package, you receive an error message. To avoid the error use /IACCEPTSQLSERVERLICENSETERMS /?

Slide 40

Monthly Security Bulletin Briefing July 2015. Security Advisory Revision Other content Product Support Lifecycle Appendix Manageability Tools Reference.

Documents

affected sql server

microsoft sql server

attack vectors ms15

exploitation unlikely

bulletin advisory

special permissions

authenticated attacker

security advisory revision