# MA-453.022015: MyCERT Advisory - Microsoft Releases Critical Security Update for Internet Explorer

**Date:** 16 Feb 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-453.022015  
**Advisory ID:** MA-453.022015

---

#### **1.0 Introduction**
Microsoft has released a critical security update to address multiple vulnerabilities in Internet Explorer. Exploitation of one of these vulnerabilities could allow a remote attacker to take control of an affected system if the user views a specially crafted webpage. Users and administrators are encouraged to review Microsoft Bulletin MS15-009 for details and apply the necessary update.
**2.0 Impact**
These updates address vulnerabilities that may allow a remote attacker to take control of an affected system if the user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
**3.0 Affected Products**
The detail lists of the affected products updates are as below:
Critical for Windows Clients:
- Internet Explorer 6 (IE 6)
- Internet Explorer 7 (IE 7)
- Internet Explorer 8 (IE 8)
- Internet Explorer 9 (IE 9)
- Internet Explorer 10 (IE 10)
- Internet Explorer 11 (IE 11)
Moderate for Windows Servers:
- Internet Explorer 6 (IE 6)
- Internet Explorer 7 (IE 7)
- Internet Explorer 8 (IE 8)
- Internet Explorer 9 (IE 9)
- Internet Explorer 10 (IE 10)
- Internet Explorer 11 (IE 11)
**4.0 Recommendation**
MyCERT recommends users and administrators to update their software by following either of these instructions below:
4.1 For Internet Explorer 6:
- [Windows Server 2003 Service Pack 2](https://www.microsoft.com/en-us/download/details.aspx?id=45685)
- [Windows Server 2003 x64 Edition Service Pack 2](https://www.microsoft.com/en-us/download/details.aspx?id=45672)
- [Windows Server 2003 with SP2 for Itanium-based Systems](https://www.microsoft.com/en-us/download/details.aspx?id=45609)
4.2 For Internet Explorer 7:
- [Windows Server 2003 Service Pack 2](https://www.microsoft.com/en-us/download/details.aspx?id=45593)
- [Windows Server 2003 x64 Edition Service Pack 2](https://www.microsoft.com/en-us/download/details.aspx?id=45582)
- [Windows Server 2003 with SP2 for Itanium-based Systems](https://www.microsoft.com/en-us/download/details.aspx?id=45688)
- [Windows Vista Service Pack 2](https://www.microsoft.com/en-us/download/details.aspx?id=45585)
- [Windows Vista x64 Edition Service Pack 2](https://www.microsoft.com/en-us/download/details.aspx?id=45711)
- [Windows Server 2008 for 32-bit Systems Service Pack 2](https://www.microsoft.com/en-us/download/details.aspx?id=45734)
- [Windows Server 2008 for x64-based Systems Service Pack 2](https://www.microsoft.com/en-us/download/details.aspx?id=45732)
- [Windows Server 2008 for Itanium-based Systems Service Pack 2](https://www.microsoft.com/en-us/download/details.aspx?id=45732)
4.3 For Internet Explorer 8:
- [Windows Server 2003 Service Pack 2](https://www.microsoft.com/en-us/download/details.aspx?id=45738)
- [Windows Server 2003 x64 Edition Service Pack 2](https://www.microsoft.com/en-us/download/details.aspx?id=45709)
- [Windows Vista Service Pack 2](https://www.microsoft.com/en-us/download/details.aspx?id=45660)
- [Windows Vista x64 Edition Service Pack 2](https://www.microsoft.com/en-us/download/details.aspx?id=45735)
- [Windows Server 2008 for 32-bit Systems Service Pack 2](https://www.microsoft.com/en-us/download/details.aspx?id=45668)
- [Windows Server 2008 for x64-based Systems Service Pack 2](https://www.microsoft.com/en-us/download/details.aspx?id=45667)
- [Windows 7 for 32-bit Systems Service Pack 1](https://www.microsoft.com/en-us/download/details.aspx?id=45615)
- [Windows 7 for x64-based Systems Service Pack 1](https://www.microsoft.com/en-us/download/details.aspx?id=45604)
- [Windows Server 2008 R2 for x64-based Systems Service Pack 1](https://www.microsoft.com/en-us/download/details.aspx?id=45736)
- [Windows Server 2008 R2 for Itanium-based Systems Service Pack](https://www.microsoft.com/en-us/download/details.aspx?id=45692)
4.4 For Internet Explorer 9:
|  |
| --- | --- | --- | Internet Explorer 9 | Remote Code Execution | Security Feature Bypass | Windows Vista Service Pack 2 | ([3021952](https://www.microsoft.com/downloads/details.aspx?FamilyID=ab2793a2-f928-4574-b3e9-7af74119f6e5)) | ([3034196](https://www.microsoft.com/downloads/details.aspx?FamilyID=8cfc1d22-89b2-4cea-8545-1cfde4c6b86f))[2] | Windows Vista x64 Edition Service Pack 2 | ([3021952](https://www.microsoft.com/downloads/details.aspx?FamilyID=4a7bf594-75c0-46f4-ae8c-55988df01eec)) | ([3034196](https://www.microsoft.com/downloads/details.aspx?FamilyID=75aa375f-66a0-456a-b132-30f85febe0ab))[2] | Windows Server 2008 for 32-bit Systems Service Pack 2 | ([3021952](https://www.microsoft.com/downloads/details.aspx?FamilyID=b4192932-1eb9-4c09-b6e4-0fc825d6d9f1)) | ([3034196](https://www.microsoft.com/downloads/details.aspx?FamilyID=cc14db95-b95f-4ebf-83eb-256c915f5cf0))[2] | Windows Server 2008 for x64-based Systems Service Pack 2 | ([3021952](https://www.microsoft.com/downloads/details.aspx?FamilyID=807e455b-8243-44e8-bf48-5c9fa3825e73)) | ([3034196](https://www.microsoft.com/downloads/details.aspx?FamilyID=d4de1a53-63eb-4fba-9b71-63a268a34f1f))[2] | Windows 7 for 32-bit Systems Service Pack 1 | ([3021952](https://www.microsoft.com/downloads/details.aspx?FamilyID=580de5da-075a-46e7-ae3e-d6a1c721878e)) | ([3034196](https://www.microsoft.com/downloads/details.aspx?FamilyID=1e197d81-42fc-40c6-bfe2-779c6d33cd23))[2] | Windows 7 for x64-based Systems Service Pack 1 | ([3021952](https://www.microsoft.com/downloads/details.aspx?FamilyID=2d9739e0-7ca7-4a2a-a706-2ddf2f31a329)) | ([3034196](https://www.microsoft.com/downloads/details.aspx?FamilyID=c1729585-b782-4b50-8acf-1f39510a846e))[2] | Windows Server 2008 R2 for x64-based Systems Service Pack 1 | ([3021952](https://www.microsoft.com/downloads/details.aspx?FamilyID=e9609acc-ef6b-4f28-9774-c407e940b383)) | ([3034196](https://www.microsoft.com/downloads/details.aspx?FamilyID=9f354c04-079c-4dd7-bade-ed9d84435dd4))[2] |
4.5 For Internet Explorer 10:
|  |
| --- | --- | --- | Internet Explorer 10 | Remote Code Execution | Security Feature Bypass | Windows 7 for 32-bit Systems Service Pack 1 | ([3021952](https://www.microsoft.com/downloads/details.aspx?FamilyID=ee8b0558-0d3c-47e5-83c6-f46f4851a5bc)) | ([3034196](https://www.microsoft.com/downloads/details.aspx?FamilyID=fc738de2-e3da-4cb3-96d7-a9db257cafee))[2] | Windows 7 for x64-based Systems Service Pack 1 | ([3021952](https://www.microsoft.com/downloads/details.aspx?FamilyID=8faab6d3-50d7-4400-9212-fd75ca397479)) | ([3034196](https://www.microsoft.com/downloads/details.aspx?FamilyID=bb7b2987-5f1d-4b2d-a981-938f5c414d57))[2] | Windows Server 2008 R2 for x64-based Systems Service Pack 1 | ([3021952](https://www.microsoft.com/downloads/details.aspx?FamilyID=2fd21efc-cac4-4246-89e4-bb0d15a2b89a)) | ([3034196](https://www.microsoft.com/downloads/details.aspx?FamilyID=23ca47a8-6859-443b-834c-16599da62dc3))[2] | Windows 8 for 32-bit Systems | ([3021952](https://www.microsoft.com/downloads/details.aspx?FamilyID=78b3bb6e-2aff-41e3-ac27-0fcde9be9742)) | ([3034196](https://www.microsoft.com/downloads/details.aspx?FamilyID=3be02b5e-9cb5-4648-b3b8-c40fdfece6c5))[2] | Windows 8 for x64-based Systems | ([3021952](https://www.microsoft.com/downloads/details.aspx?FamilyID=4b13cd8e-524a-4f8d-b4e9-8591e36c5c46)) | ([3034196](https://www.microsoft.com/downloads/details.aspx?FamilyID=2ea1186d-d2d7-45c2-a4df-4e0e56d11138))[2] | Windows Server 2012 | ([3021952](https://www.microsoft.com/downloads/details.aspx?FamilyID=4ba22653-4dbf-48d0-8a95-7b38e5d23cbe)) | ([3034196](https://www.microsoft.com/downloads/details.aspx?FamilyID=59d5cb32-a2f6-4e9b-ac52-d9378a94b6b5))[2] | Windows RT | (3021952)[3] | (3034196)[2][3] |
4.6 For Internet Explorer 11:
|  |
| --- | --- | --- | Internet Explorer 11 | Remote Code Execution | Security Feature Bypass | Windows 7 for 32-bit Systems Service Pack 1 | ([3021952](https://www.microsoft.com/downloads/details.aspx?FamilyID=4ada6cb2-f0d0-4e8a-b7d8-0c4cb5c25c70)) | ([3034196](https://www.microsoft.com/downloads/details.aspx?FamilyID=44dd4ef7-e770-433a-b868-0b92ebfcd760))[2] | Windows 7 for x64-based Systems Service Pack 1 | ([3021952](https://www.microsoft.com/downloads/details.aspx?FamilyID=9547dc36-d73e-483a-8f5c-ea16000446ca)) | ([3034196](https://www.microsoft.com/downloads/details.aspx?FamilyID=eee620ed-df72-43de-873f-8029692d4737))[2] | Windows Server 2008 R2 for x64-based Systems Service Pack 1 | ([3021952](https://www.microsoft.com/downloads/details.aspx?FamilyID=32dc2f44-009f-4084-8e70-db9dce0eba8f)) | ([3034196](https://www.microsoft.com/downloads/details.aspx?FamilyID=93b7dbe0-5c1d-444f-ae9f-12cf81c92900))[2] | Windows 8.1 for 32-bit Systems | ([3021952](https://www.microsoft.com/downloads/details.aspx?FamilyID=076daf19-a6c3-41b1-8f58-68ca16a3d179)) | ([3034196](https://www.microsoft.com/downloads/details.aspx?FamilyID=c501fec2-82a0-4371-98d7-2d63916e9eac))[2] | Windows 8.1 for x64-based Systems | ([3021952](https://www.microsoft.com/downloads/details.aspx?FamilyID=cd8262b0-a98a-435d-ab9e-7ad09f01391e)) | ([3034196](https://www.microsoft.com/downloads/details.aspx?FamilyID=3bb43e28-4d91-461e-8cb4-024400111d75))[2] | Windows Server 2012 R2 | ([3021952](https://www.microsoft.com/downloads/details.aspx?FamilyID=89594df0-bd4d-4fb0-9c4d-e1b57af6eba9)) | ([3034196](https://www.microsoft.com/downloads/details.aspx?FamilyID=66b5447e-77ed-41e7-97ea-e4ba71145ba2))[2] | Windows RT 8.1 | (3021952)[3] | (3034196)[2][3] |
Note :
[2]Customers who install updates manually must install update 3021952 before installing update 3034196.
[3]This update is available via Windows Update.
4.7 Microsoft has released an update addressing this vulnerability.
Kindly refer to [Microsoft Bulletin MS15-009](https://technet.microsoft.com/library/security/MS15-009). Users are recommended to perform the update immediately. All of the patches could be done almost automatically via the Windows Update application.
The how-to perform of the Windows Update is available at the following URL:
- <http://www.mycert.org.my/en/resources/os/main/main/detail/707/index.html>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#f6958f949384cfcfcfb6958f94938485939583849f828fd89b8f) or [[email protected]](/cdn-cgi/l/email-protection#3954405a5c4b4d7954405a5c4b4d17564b5e175440) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <https://www.twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- Microsoft Releases Critical Security Update for Internet Explorer  [https://www.us-cert.gov/ncas/current-activity/2015/02/10/Microsoft-Releases-Critical-Security-Update-Internet-Explorer](https://www.us-cert.gov/ncas/current-activity/2015/02/10/Microsoft-%09Releases-Critical-Security-Update-Internet-Explorer)
- Microsoft's Patch Tuesday release leaves one big vulnerability unpatched <http://www.zdnet.com/article/february-2015-patch-tuesday/>
- Microsoft Security Bulletin MS15-009 - Critical <https://technet.microsoft.com/library/security/MS15-009Adobe>