May 2015 Microsoft Patch Tuesday Summary - SANS Internet Storm Center

Overview of the May 2015 Microsoft patches and their status.

#	Affected	Contra Indications - KB	Known Exploits	Microsoft rating(**)	ISC rating(*)
#	Affected	Contra Indications - KB	Known Exploits	Microsoft rating(**)	clients	servers
MS15-043	Cumulative Security Update for Internet Explorer (Replaces MS15-032 )
MS15-043	CVE-2015-1658, CVE-2015-1684, CVE-2015-1685, CVE-2015-1686, CVE-2015-1688, CVE-2015-1689, CVE-2015-1691, CVE-2015-1692, CVE-2015-1694, CVE-2015-1703, CVE-2015-1704, CVE-2015-1705, CVE-2015-1706, CVE-2015-1708, CVE-2015-1709, CVE-2015-1710, CVE-2015-1711, CVE-2015-1712, CVE-2015-1713, CVE-2015-1714, CVE-2015-1717, CVE-2015-1718	KB 3049563	.	Severity:Critical Exploitability: 1	Critical	Critical
MS15-044	Vulnerabilities in Microsoft Font Drivers Could Allow Remote Code Execution (ReplacesMS13-034 MS13-082 MS15-023 )
MS15-044	CVE-2015-1670 CVE-2015-1671	KB 3057110	.	Severity:Critical Exploitability: 1	Critical	Critical
MS15-045	Vulnerability in Windows Journal Could Allow Remote Code Execution (Replaces MS14-038 )
MS15-045	CVE-2015-1675 CVE-2015-1695 CVE-2015-1696 CVE-2015-1697 CVE-2015-1698 CVE-2015-1699	KB 3046002	.	Severity:Critical Exploitability: 2	Critical	Critical
MS15-046	Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (ReplacesMS13-085 MS15-012 MS15-022 MS15-033 )
MS15-046	CVE-2015-1682 CVE-2015-1683	KB 3057181	.	Severity:Important Exploitability: 1	Critical	Important
MS15-047	Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution (Replaces MS12-066 MS15-022 )
MS15-047	CVE-2015-1700	KB 3058083	.	Severity:Important Exploitability: 2	Important	Critical
MS15-048	Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (Replaces MS12-038 MS13-015 MS13-040 MS13-082 MS14-009 )
MS15-048	CVE-2015-1672 CVE-2015-1673	KB 3057134	.	Severity:Important Exploitability: 3	Important	Important
MS15-049	Vulnerability in Silverlight Could Allow Elevation of Privilege (Replaces MS14-014 )
MS15-049	CVE-2015-1715	KB 3058985	.	Severity:Important Exploitability: 2	Important	Important
MS15-050	Vulnerability in Service Control Manager Could Allow Elevation of Privilege
MS15-050	CVE-2015-1702	KB 3055642	.	Severity:Important Exploitability: 2	Important	Important
MS15-051	Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (ReplacesMS15-023 )
MS15-051	CVE-2015-1676 CVE-2015-1677 CVE-2015-1678 CVE-2015-1679 CVE-2015-1680 CVE-2015-1701	KB 3057191	vuln. public.	Severity:Important Exploitability: 0	Important	Important
MS15-052	Vulnerability in Windows Kernel Could Allow Security Feature Bypass (Replaces MS15-010 )
MS15-052	CVE-2015-1674	KB 3050514	.	Severity:Important Exploitability: 2	Important	Important
MS15-053	Vulnerabilities in JScript and VBScript Scripting Engines Could Allow Security Feature Bypass (ReplacesMS11-031 MS12-056 )
MS15-053	CVE-2015-1684 CVE-2015-1686	KB 3057263	.	Severity:Important Exploitability: 2	Important	Important
MS15-054	Vulnerability in Microsoft Management Console File Format Could Allow Denial of Service
MS15-054	CVE-2015-1681	KB 3051768	.	Severity:Important Exploitability: 2	Important	Important
MS15-055	Vulnerability in Schannel Could Allow Information Disclosure (ReplacesMS15-031 )
MS15-055	CVE-2015-1716	KB 3061518	.	Severity:Important Exploitability: 1	Important	Important

We will update issues on this page for about a week or so as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY

(*): ISC rating

We use 4 levels:
- PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
- Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
- Important: Things where more testing and other measures can help.
- Less Urt practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
- The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threatatches.

---
Johannes B. Ullrich, Ph.D.
STI|Twitter|LinkedIn

I will be teaching next: Application Security: Securing Web Apps, APIs, and Microservices - SANS London June 2022

Johannes

4479 Posts
ISC Handler

May 13th 2015

Win7/64bit computer stuck at Stage 1 of 3 - 23% complete. (after being told to reboot after patching)

I seem to remember this happening 2-3 months ago.

K-Dee

68 Posts

Looks like KB3061518 is breaking client communications with Catia (DSLS) license servers. Removing the update fixes the problem.

K-Dee
1 Posts

Systems stuck on configuring updates stage 3 of 3. [can also be 1 of 3 or 2 of 3 as noted above]

Solution: hit control alt delete.

No root cause, no one particular update has been identified.

Sources:

https://twitter.com/search?q=stage%203%20windows&src=tyah
http://marc.info/?l=patchmanagement&m=143155248121077&w=2
https://www.reddit.com/r/sysadmin/comments/35tnk3/stuck_on_windows_update_33_this_morning_hit/

Susan

34 Posts

Had one of those happen today, where CTRL-ALT-DEL worked. My system from yesterday tho was completely locked up and its problem happened BEFORE the reboot. The little circle was not spinning and there was no hard drive activity. Did a hard reset on that one and everything came up fine.... and all patches showed as installed.

K-Dee

68 Posts