# MA-471.042015: MyCERT Alert - Microsoft Security Bulletin Summary for April 2015

**Date:** 21 Apr 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-471.042015  
**Advisory ID:** MA-471.042015

---

#### **1.0 Introduction** Microsoft has released eleven updates to address vulnerabilities in Microsoft Windows. Some of these vulnerabilities could allow elevation of privilege, denial of service, remote code execution, information disclosure, or security feature bypass.
**2.0 The list of the Important vulnerabilities are as below:2.1 Cumulative Security Update for Internet Explorer (3038314)**
This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
**Patch**: <http://go.microsoft.com/fwlink/?LinkId=532626>>
**2.2 Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3048019)** 
This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
**Patch**: <http://go.microsoft.com/fwlink/?LinkId=532628>
**2.3 Vulnerability in HTTP.sys Could Allow Remote Code Execution (3042553)**
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if an attacker sends a specially crafted HTTP request to an affected Windows system.
**Patch**: <http://go.microsoft.com/fwlink/?LinkId=532630>
**2.4 Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution (3046306)**
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if an attacker successfully convinces a user to browse to a specially crafted website, open a specially crafted file, or browse to a working directory that contains a specially crafted Enhanced Metafile (EMF) image file. In all cases, however, an attacker would have no way to force users to take such actions; an attacker would have to convince users to do so, typically by way of enticements in email or Instant Messenger messages.
**Patch:** <http://go.microsoft.com/fwlink/?LinkId=532631>
**2.5 Vulnerabilities in Microsoft SharePoint Server Could Allow Elevation of Privilege (3052044)**
This security update resolves vulnerabilities in Microsoft Office server and productivity software. The vulnerabilities could allow elevation of privilege if an attacker sends a specially crafted request to an affected SharePoint server. An attacker who successfully exploited the vulnerabilities could read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the victim, such as change permissions and delete content, and inject malicious content in the victim’s browser.
**Patch:** <http://go.microsoft.com/fwlink/?LinkId=532634>
**2.6 Vulnerability in Windows Error Reporting Could Allow Security Feature Bypass (3004365) Vulnerability in Windows Task Scheduler Could Allow Elevation of Privilege (3046269)**
This security update resolves a vulnerability in Microsoft Windows. An attacker who successfully exploited the vulnerability could leverage a known invalid task to cause Task Scheduler to run a specially crafted application in the context of the System account. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
**Patch**: <http://go.microsoft.com/fwlink/?LinkId=532635>
**2.7 Vulnerabilities in Microsoft Windows Could Allow Elevation of Privilege (3049576)** 
This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logs on to the system and runs a specially crafted application. To exploit these vulnerabilities, an attacker would first have to log on to the system.
**Patch**: <http://go.microsoft.com/fwlink/?LinkId=532639>
**2.8 Vulnerability in XML Core Services Could Allow Security Feature Bypass (3046482)** 
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow security feature bypass if a user clicks a specially crafted link. In all cases, however, an attacker would have no way to force users to click a specially crafted link; an attacker would have to convince users to click the link, typically by way of an enticement in an email or Instant Messenger message.
**Patch:** <http://go.microsoft.com/fwlink/?LinkId=532641>
**2.9 Vulnerability in Active Directory Federation Services Could Allow Information Disclosure (3045711)** 
This security update resolves a vulnerability in Active Directory Federation Services (AD FS). The vulnerability could allow information disclosure if a user leaves their browser open after logging off from an application and an attacker reopens the application in the browser immediately after the user has logged off.
**Patch:** <http://go.microsoft.com/fwlink/?LinkId=532642>
**2.10 Vulnerability in .NET Framework Could Allow Information Disclosure (3048010)**
This security update resolves a vulnerability in Microsoft .NET Framework. The vulnerability could allow information disclosure if an attacker sends a specially crafted web request to an affected server that has custom error messages disabled. An attacker who successfully exploited the vulnerability would be able to view parts of a web configuration file, which could expose sensitive information.
**Patch:** <http://go.microsoft.com/fwlink/?LinkId=532643>
**2.11 Vulnerability in Windows Hyper-V Could Allow Denial of Service (3047234)**
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow denial of service if an authenticated attacker runs a specially crafted application in a virtual machine (VM) session. Note that the denial of service does not allow an attacker to execute code or elevate user rights on other VMs running on the Hyper-V host; however, it could cause other VMs on the host to not be manageable in Virtual Machine Manager.
**Patch:** <http://go.microsoft.com/fwlink/?LinkId=532644>
**3.0 Recommendation**
Users are recommended to perform the update immediately. All of the patches could be done almost automatically via the Windows Update application.
The how-to perform of the Windows Update is available at the following URL:
- [https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4
)
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#adced4cfc8df949494edced4cfc8dfdec8ced8dfc4d9d483c0d4) or [[email protected]](/cdn-cgi/l/email-protection#44293d2721363004293d272136306a2b36236a293d) 
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442 
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <http://www.twitter.com/mycert>
**4.0References**
- [US-CERT: Microsoft Releases January 2015 Security Bulletin](https://www.us-cert.gov/ncas/current-activity/2015/04/14/Microsoft-Releases-April-2015-Security-Bulletin)
- [Microsoft Security Bulletin Summary for April 2015](https://technet.microsoft.com/en-us/library/security/ms15-apr.aspx)