Ivanti December 2015 Patch Tuesday Analysis Webinar – Formerly Shavlik

1. Chris Goettl
Sr. Product Manager
Minimizing the Impact of Patch Tuesday
Wednesday, December 9th, 2015
Dial In: 1-855-749-4750 (US)
Attendees: 922 990 888

2. Shavlik Confidential
 Feel free to ask questions via the online Q&A link in the WebEx
interface.
 Questions may be answered during the presentation.
 Unanswered questions will be resolved via email after the
presentation is over.
 A copy of this presentation will be available at
http://www.shavlik.com/webinars/ after the webinar.
2
Logistics

3. Shavlik Confidential
 December 2015 Patch Tuesday Overview
 Review December 2015 Security Bulletins
 Patch Recommendations
 Other patches released since last Patch Tuesday
3
Agenda

4. Shavlik Confidential4

5. Shavlik Confidential
 12 Microsoft Security Bulletins / 71 Vulnerabilities Addressed
 Adobe Flash Player Bulletin / 78 Vulnerabilities Addressed
 Google Chrome Release / 7+ Vulnerability Addressed + 78 from Flash Player Plug-In
 Affected Products:
 All supported Windows operating systems
 Internet Explorer, Edge
 Microsoft Office 2010, 2013
 .Net Framework
 Microsoft Lync
 Skype for Business
 Silverlight
 Adobe Flash Player
 Google Chrome
5
Patch Tuesday Overview for December 2015

6. Shavlik Confidential
 Security Bulletins:
 8 bulletin is rated as Critical.
 4 bulletins are rated as Important.
 Vulnerability Impact:
 10 bulletins address vulnerabilities that could allow Remote Code Execution.
 2 bulletins address vulnerabilities that could allow Elevation of Privileges.
6
Overview for Microsoft December 2015

7. Shavlik Confidential
 Security Bulletins:
 Adobe Flash Player (Priority 1)
 Google Chrome (High)
 Vulnerability Impact:
 Adobe Flash Player addresses vulnerabilities that could allow Code Execution and Security Feature
Bypass.
 Google Chrome addresses a vulnerability that could allow type confusion, use-after-free, escaping
issues and allows the Flash Player Plug-In update resolving the additional Flash vulnerabilities.
7
Overview for 3rd Party Vendors December 2015

8. Shavlik Confidential
• From a bulletin perspective, many of the updates this
month overlap. Some bulletins may also apply to the
same machine multiple times for different affected
products.
• Adobe Flash Player distribution changes coming
January 22nd, 2016.
• Internet Explorer changes coming January 12th, 2016.
8
Known Issues Things to watch out for

9. Shavlik Confidential
 Maximum Severity: Critical
 Affected Products: Windows 10, Edge, Internet Explorer, .Net Framework
 Description: This update for Windows 10 includes functionality improvements and resolves the vulnerabilities in Windows that are
described in the following Microsoft security bulletins and advisory: 3119075 MS15-135, 3116130 MS15-133, 3116162 MS15-132,
3104503 MS15-128, 3116178 MS15-126, 3116184 MS15-125, 3116180 MS15-124.
 Impact: Remote Code Execution, Elevation of Privilege
 Fixes 58 vulnerabilities:
 CVE-2015-6083, CVE-2015-6134, CVE-2015-6135, CVE-2015-6136, CVE-2015-6138, CVE-2015-6139, CVE-2015-6140, CVE-2015-
6141, CVE-2015-6142, CVE-2015-6143, CVE-2015-6144, CVE-2015-6145, CVE-2015-6146, CVE-2015-6147, CVE-2015-6148, CVE-
2015-6149, CVE-2015-6150, CVE-2015-6151, CVE-2015-6152, CVE-2015-6153, CVE-2015-6154, CVE-2015-6155, CVE-2015-6156,
CVE-2015-6157, CVE-2015-6158, CVE-2015-6159, CVE-2015-6160, CVE-2015-6161, CVE-2015-6162, CVE-2015-6164, CVE-2015-
6139, CVE-2015-6140, CVE-2015-6142, CVE-2015-6148, CVE-2015-6151, CVE-2015-6153, CVE-2015-6154, CVE-2015-6155, CVE-
2015-6158, CVE-2015-6159, CVE-2015-6161, CVE-2015-6168, CVE-2015-6169, CVE-2015-6170, CVE-2015-6176, CVE-2015-6135,
CVE-2015-6136, CVE-2015-6106, CVE-2015-6107, CVE-2015-6108, CVE-2015-6128, CVE-2015-6132, CVE-2015-6133, CVE-2015-
6126, CVE-2015-6171, CVE-2015-6173, CVE-2015-6174, CVE-2015-6175 (Publicly Disclosed, Exploited in Wild)
 Replaces: CSWU-015
 Restart Required: Requires Restart
9
CSWU-016: Cumulative update for Windows 10: December 8, 2015

10. Shavlik Confidential
 Maximum Severity: Critical
 Affected Products: Internet Explorer
 Description: This security update resolves vulnerabilities in Internet Explorer. The most severe of the
vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer.
An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user.
Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those
who operate with administrative user rights.
 Impact: Remote Code Execution
 Fixes 30 vulnerabilities:
 CVE-2015-6083, CVE-2015-6134, CVE-2015-6135, , CVE-2015-6136, CVE-2015-6138, CVE-2015-6139, CVE-
2015-6140, , VE-2015-6141, CVE-2015-6142, CVE-2015-6143, CVE-2015-6144, CVE-2015-6145, CVE-2015-
6146, CVE-2015-6147, CVE-2015-6148, CVE-2015-6149, CVE-2015-6150, CVE-2015-6151, CVE-2015-6152,
CVE-2015-6153, CVE-2015-6154, CVE-2015-6155, , CVE-2015-6156, CVE-2015-6157, CVE-2015-6158, CVE-
2015-6159, CVE-2015-6160, CVE-2015-6161, CVE-2015-6162, CVE-2015-6164
 Replaces: 3100773 in MS15-112, 3105213 in MS15-112, 3105211 in MS15-112
 Restart Required: Requires Restart
10
MS15-124: Cumulative Security Update for Internet Explorer (3116180)

11. Shavlik Confidential
 Maximum Severity: Critical
 Affected Products: Windows, Edge
 Description: This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities
could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who
successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose
accounts are configured to have fewer user rights on the system could be less impacted than those who operate with
administrative user rights.
 Impact: Remote Code Execution
 Fixes 15 vulnerabilities:
 CVE-2015-6139, CVE-2015-6140, CVE-2015-6142, CVE-2015-6148, CVE-2015-6151, CVE-2015-6153, CVE-
2015-6154, CVE-2015-6155, CVE-2015-6158, CVE-2015-6159, CVE-2015-6161, CVE-2015-6168, CVE-2015-
6169, CVE-2015-6170, CVE-2015-6176
 Replaces: 3105213 in MS15-113, 3105211 in MS15-113
 Restart Required: Requires Restart
11
MS15-125: Cumulative Security Update for Microsoft Edge (3116184)

12. Shavlik Confidential
 Maximum Severity: Critical
 Affected Products: Windows
 Description: This security update resolves vulnerabilities in the VBScript scripting engine in Microsoft Windows.
The more severe of the vulnerabilities could allow remote code execution if an attacker hosts a specially crafted
website that is designed to exploit the vulnerabilities through Internet Explorer (or leverages a compromised website or
a website that accepts or hosts user-provided content or advertisements) and then convinces a user to view the
website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft
Office document that uses the Internet Explorer rendering engine to direct the user to the specially crafted website.
 Impact: Remote Code Execution
 Fixes 2 vulnerabilities:
 CVE-2015-6135, CVE-2015-6136
 Replaces: 3068368 in MS15-066,
 Restart Required: May Require Restart
12
MS15-126: Cumulative Security Update for JScript and VBScript to
Address Remote Code Execution (3116178)

13. Shavlik Confidential
 Maximum Severity: Critical
 Affected Products: Windows
 Description: This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow
remote code execution if an attacker sends specially crafted requests to a DNS server.
 Impact: Remote Code Execution
 Fixes 1 vulnerabilities:
 CVE-2015-6125
 Replaces: 2647170 in MS12-017,
 Restart Required: Requires Restart
13
MS15-127: Security Update for Microsoft Windows DNS to Address
Remote Code Execution (3100465)

14. Shavlik Confidential
 Maximum Severity: Critical
 Affected Products: Windows, Office, .Net Framework, Lync, Skype, Silverlight
 Description: This security update resolves vulnerabilities in Microsoft Windows, .NET Framework, Microsoft Office,
Skype for Business, Microsoft Lync, and Silverlight. The vulnerabilities could allow remote code execution if a user
opens a specially crafted document or visits a webpage that contains specially crafted embedded fonts..
 Impact: Remote Code Execution
 Fixes 3 vulnerabilities:
 CVE-2015-6106, CVE-2015-6107, CVE-2015-6108
 Replaces: 3097877 in MS15-115, 3085529 in MS15-097, 3072303 in MS15-080,
3048068 in MS15-044, 3072310 in MS15-080, 3048077 in MS15-044, 3080333
in MS15-080
 Restart Required: Requires Restart
14
MS15-128: Security Update for Microsoft Graphics Component to
Address Remote Code Execution (3104503)

15. Shavlik Confidential
 Maximum Severity: Critical
 Affected Products: Silverlight
 Description: This security update resolves vulnerabilities in Microsoft Silverlight. The most severe of the
vulnerabilities could allow remote code execution if Microsoft Silverlight incorrectly handles certain open and close
requests that could result in read- and write-access violations. To exploit the vulnerability, an attacker could host a
website that contains a specially crafted Silverlight application and then convince a user to visit a compromised
website. The attacker could also take advantage of websites containing specially crafted content, including those that
accept or host user-provided content or advertisements.
 Impact: Remote Code Execution
 Fixes 3 vulnerabilities:
 CVE-2015-6114, CVE-2015-6165, CVE-2015-6166,
 Replaces: 3080333 in MS15-080,
 Restart Required: Does not require restart
15
MS15-129: Security Update for Silverlight to Address Remote Code
Execution (3106614)

16. Shavlik Confidential
 Maximum Severity: Critical
 Affected Products: Windows
 Description: This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow
remote code execution if a user opens a specially crafted document or visits an untrusted webpage that contains
specially crafted fonts.
 Impact: Remote Code Execution
 Fixes 1 vulnerabilities:
 CVE-2015-6130
 Replaces: 2957509 in MS14-036
 Restart Required: Requires Restart
16
MS15-130: Security Update for Microsoft Uniscribe to Address Remote
Code Execution (3108670)

17. Shavlik Confidential
 Maximum Severity: Critical
 Affected Products: Office
 Description: This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities
could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who
successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose
accounts are configured to have fewer user rights on the system could be less impacted than those who operate with
administrative user rights.
 Impact: Remote Code Execution
 Fixes 6 vulnerabilities:
 CVE-2015-6040, CVE-2015-6118, CVE-2015-6122, CVE-2015-6124 (Exploited in Wild), CVE-2015-6172,
CVE-2015-6177
 Replaces: 2837610 in MS15-081, 2598244 in MS15-081, 3101513 in MS15-116,
3101560 in MS15-116
 Restart Required: May Require Restart
17
MS15-131: Security Update for Microsoft Office to Address Remote
Code Execution (3116111)

18. Shavlik Confidential
 Maximum Severity: Important
 Affected Products: Windows
 Description: This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow
elevation of privilege if an attacker logs on to a target system and runs a specially crafted application.
 Impact: Elevation of Privilege
 Fixes 4 vulnerabilities:
 CVE-2015-6171, CVE-2015-6173, CVE-2015-6174, CVE-2015-6175 (Publicly Disclosed, Exploited in Wild)
 Replaces: 3097877 in MS15-115
 Restart Required: Requires Restart
18
MS15-135: Security Update for Windows Kernel-Mode Drivers to
Address Elevation of Privilege (3119075)

19. Shavlik Confidential
 Maximum Severity: Priority 1
 Affected Products: Flash Player, AIR
 Description: Adobe has released security updates for Adobe Flash Player. These updates
address critical vulnerabilities that could potentially allow an attacker to take control of the affected system..
 Impact: Security Feature Bypass, Code Execution
 Fixes 78 vulnerabilities:
 See notes for list…
 Replaces: All previous versions
 Restart Required: May Require Restart
19
APSB15-32: Security updates available for Adobe Flash Player

20. Shavlik Confidential
 Maximum Severity: High
 Affected Products: Google Chrome
 Description: The stable channel has been updated to 47.0.2526.80 for Windows, Mac, and Linux. This release
contains an update to Adobe Flash Player (20.0.0.228) and security fixes..
 Impact: type confusion, use-after-free, escaping issues
 Fixes 7+ vulnerabilities:
 CVE-2015-6788, CVE-2015-6789, CVE-2015-6790, CVE-2015-6791
 Replaces: All previous versions
 Restart Required: Browser Reboot Required
20
Chrome-154: Google Chrome 47.0.2526.80

21. Shavlik Confidential
 Maximum Severity: Important
 Affected Products: Microsoft Windows
 Description: This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow
remote code execution if an attacker accesses a local system and runs a specially crafted application.
 Impact: Remote Code Execution
 Fixes 3 vulnerabilities:
 CVE-2015-6128, CVE-2015-6132, CVE-2015-6133
 Replaces: 3101246 in MS15-122,
 Restart Required: May Require Restart
21
MS15-132: Security Update for Microsoft Windows to Address Remote
Code Execution (3116162)

22. Shavlik Confidential
 Maximum Severity: Important
 Affected Products: Microsoft Windows
 Description: This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow
elevation of privilege if an attacker logs on to a target system and runs a specially crafted application that, by way of a
race condition, results in references to memory locations that have already been freed. Microsoft Message Queuing
(MSMQ) must be installed and the Windows Pragmatic General Multicast (PGM) protocol specifically enabled for a
system to be vulnerable. MSMQ is not present in default configurations and, if it is installed, the PGM protocol is
available but disabled by default.
 Impact: Elevation of Privilege
 Fixes 1 vulnerabilities:
 CVE-2015-6126
 Replaces: none
 Restart Required: Requires Restart
22
MS15-133: Security Update for Windows PGM to Address Elevation of
Privilege (3116130)

23. Shavlik Confidential
 Maximum Severity: Important
 Affected Products: Microsoft Windows
 Description: This security update resolves vulnerabilities in Microsoft Windows. The more severe of the
vulnerabilities could allow remote code execution if Windows Media Center opens a specially crafted Media Center link
(.mcl) file that references malicious code. An attacker who successfully exploited this vulnerability could gain the same
user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system
could be less impacted than those who operate with administrative user rights.
 Impact: Remote Code Execution
 Fixes 1 vulnerabilities:
 CVE-2015-2478
 Replaces: 3087918 in MS15-100,
 Restart Required: May Require Restart
23
MS15-134: Security Update for Windows Media Center to Address
Remote Code Execution (3108669)

24. Shavlik Confidential
 Opera release updates to latest Chrome Frame.
24
Other lower priority updates for December

25. Shavlik Confidential25
Review Patch Releases Since November Patch Tuesday
• Microsoft: 47 (Non-Security), 0 (Security
Advisories), 0 (Security Tool), 6 (Security)
• CDBurnerXP: 1 (Non-Security)
• Opera: 1 (Security)
• RealTimes: 1 (Security)
• Skype: 4 (Security)
• CoreFTP: 1 (Non-Security)
• Cshell: 1 (Non-Security)
• Google Drive: 1 (Non-Secuirty)
• VMware Player: 1 (Non-Security)
• Wireshark: 1 (Security)
• GoToMeeting: 1 (Non-Security)
• Java 8: 1 (Non-Security)
• Adobe Shockwave: 1 (Security)
• 7-Zip: 1 (Non-Security)
• Gimp: 1 (Non-Security)
• WinRAR: 1 (Non-Security)
• Adobe Acrobat Reader DC: 1 (Security)
• Google Chrome: 1 (Security)
• Notepad++: 1 (Security)
• Thunderbird: 1 (Security)
• Ccleaner: 1 (Non-Security)
• Tomcat: 1 (Non-Security)
• TeamViewer: 1 (Non-Security)
• VDA Core Services: 2 (Non-Security)
• Citrix XenApp: 1 (Non-Security)
• Dropbox: 1 (Non-Security)

26. Q&A

27. Shavlik Confidential
• Shavlik Protect 9.2 Update 1 is available. Includes 7 fixes for known issues since release on
November 19th.
• Slide deck and video playback available here: www.shavlik.com/Webinars
• Sign up for next months Patch Tuesday Webinar and view webinar playbacks:
http://www.shavlik.com/webinars/
• Sign up for Content Announcements:
• Email http://www.shavlik.com/support/xmlsubscribe/
• RSS http://protect7.shavlik.com/feed/
• Twitter @ShavlikXML
• Follow us on:
• Shavlik on LinkedIn
• Twitter @ShavlikProtect
• Shavlik blog -> www.shavlik.com/blog
• Chris Goettl on LinkedIn
• Twitter @ChrisGoettl
27
Resources and Webinars