Consejos de seguridad de Zscaler

Aviso de seguridad - December 08, 2015

Zscaler Protects against Multiple Security Vulnerabilities Internet Explorer, Microsoft Edge, Windows Media Center, and Windows Kernel Mode Drivers

  1. Overview

Zscaler, working with Microsoft through their MAPP program, has proactively deployed protections for the following 24 vulnerabilities included in the December 2015 Microsoft security bulletins.  Zscaler will continue to monitor exploits associated with all vulnerabilities in the December release and deploy additional protections as necessary.

MS15-124 – Cumulative Security Update for Internet Explorer

Severity: Critical
Affected Software

  • Internet Explorer 7
  • Internet Explorer 8
  • Internet Explorer 9
  • Internet Explorer 10
  • Internet Explorer 11

CVE-2015-6083 – Internet Explorer Memory Corruption Vulnerability

CVE-2015-6134 – Internet Explorer Memory Corruption Vulnerability

CVE-2015-6140 – Microsoft Browser Memory Corruption Vulnerability

CVE-2015-6141 – Internet Explorer Memory Corruption Vulnerability

CVE-2015-6142 – Microsoft Browser Memory Corruption Vulnerability

CVE-2015-6143 – Internet Explorer Memory Corruption Vulnerability

CVE-2015-6145 – Internet Explorer Memory Corruption Vulnerability

CVE-2015-6146 – Internet Explorer Memory Corruption Vulnerability

CVE-2015-6147 – Internet Explorer Memory Corruption Vulnerability

CVE-2015-6148 – Microsoft Browser Memory Corruption Vulnerability

CVE-2015-6149 – Internet Explorer Memory Corruption Vulnerability

CVE-2015-6150 – Internet Explorer Memory Corruption Vulnerability

CVE-2015-6152 – Internet Explorer Memory Corruption Vulnerability

CVE-2015-6154 – Microsoft Browser Memory Corruption Vulnerability

CVE-2015-6156 – Internet Explorer Memory Corruption Vulnerability

CVE-2015-6159 – Microsoft Browser Memory Corruption Vulnerability

CVE-2015-6160 – Internet Explorer Memory Corruption Vulnerability

CVE-2015-6164 – Internet Explorer XSS Filter Bypass Vulnerability

Description: This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

MS15-125 – Cumulative Security Update for Microsoft Edge

Severity: Critical
Affected Software

  • Microsoft Edge

CVE-2015-6168 – Microsoft Edge Memory Corruption Vulnerability

Description: This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

MS15-134 – Security Update for Windows Media Center to Address Remote Code Execution

Severity: Important
Affected Software

  • Windows Vista SP2
  • Windows 7 SP 1
  • Windows 8 and Windows 8.1

CVE-2015-6127 – Windows Media Center Information Disclosure Vulnerability

Description: This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow remote code execution if Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

MS15-135 – Security Update for Windows Kernel Mode Drivers to Address Elevation of Privilege

Severity: Important 
Affected Software

  • Windows Vista SP2
  • Windows Server 2008 SP 2
  • Windows 7 SP 1
  • Windows Server 2008 R2 SP 1
  • Windows 8 and Windows 8.1
  • Windows Server 2012
  • Windows RT and Windows RT 8.1
  • Windows 10

CVE-2015-6171 – Windows Kernel Memory Elevation of Privilege Vulnerability

CVE-2015-6173 – Windows Kernel Memory Elevation of Privilege Vulnerability

CVE-2015-6174 – Windows Kernel Memory Elevation of Privilege Vulnerability

CVE-2015-6175 – Windows Kernel Memory Elevation of Privilege Vulnerability

Description: This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logs on to a target system and runs a specially crafted application.