Zscaler Security Advisories

Security Advisory - September 13, 2016

Zscaler protects against 16 new vulnerabilities for Internet Explorer, Kernel-Mode Drivers, Microsoft Office, and Windows PDF Library

  1. Overview

Zscaler, working with Microsoft through their MAPP program, has proactively deployed protections for the following 16 vulnerabilities included in the September 2016 Microsoft security bulletins. Zscaler will continue to monitor exploits associated with all vulnerabilities in the September release and deploy additional protections as necessary.

MS16-104 – Cumulative Security Update for Internet Explorer

This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Severity: Critical 

Affected Software

  • Internet Explorer 9-11

    CVE-2016-3247 – Microsoft Browser Memory Corruption Vulnerability
    CVE-2016-3295 – Microsoft Browser Memory Corruption Vulnerability
    CVE-2016-3297 – Microsoft Browser Memory Corruption Vulnerability
    CVE-2016-3324 – Internet Explorer Memory Corruption Vulnerability
    CVE-2016-3351 – Microsoft Browser Information Disclosure Vulnerability

MS16-105 – Cumulative Security Update for Microsoft Edge

This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than users with administrative user rights.

Severity: Critical 

Affected Software

  • Microsoft Edge on Windows 10

CVE-2016-3294 – Microsoft Edge Memory Corruption Vulnerability
CVE-2016-3377 – Scripting Engine Memory Corruption Vulnerability

MS16-106 – Security Update for Microsoft Graphics Component

This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if a user either visits a specially crafted website or opens a specially crafted document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Severity: Important 

Affected Software

  • Windows Vista SP2
  • Windows Server 2008 SP2 and Windows Server 2008 R2 SP1
  • Windows 7 SP1
  • Windows 8.1
  • Windows Server 2012 and Windows Server 2012 R2
  • Windows RT 8.1
  • Windows 10

CVE-2016-3348 – Win32k Elevation of Privilege Vulnerability
CVE-2016-3355 – GDI Elevation of Privilege Vulnerability

              MS16-111 – Security Update for Windows Kernel

This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker runs a specially crafted application on a target system.

Severity: Important 

Affected Software

  • Windows Vista SP2
  • Windows Server 2008 SP2 and Windows Server 2008 R2 SP1
  • Windows 7 SP1
  • Windows 8.1
  • Windows Server 2012 and Windows Server 2012 R2
  • Windows RT 8.1
  • Windows 10

CVE-2016-3305 – Windows Session Object Elevation of Privilege Vulnerability
CVE-2016-3306 – Windows Session Object Elevation of Privilege Vulnerability
CVE-2016-3371 – Windows Kernel Elevation of Privilege Vulnerability
CVE-2016-3373 – Windows Kernel Elevation of Privilege Vulnerability

MS16-115 – Security Update for Microsoft Windows PDF Library

This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user views specially crafted PDF content online or opens a specially crafted PDF document. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Severity: Important 

Affected Software

  • Windows 8.1
  • Windows Server 2012 
  • Windows Server 2012 RT
  • Windows 10

CVE-2016-3370 – Microsoft PDF Remote Code Execution Vulnerability
CVE-2016-3374 – Microsoft PDF Remote Code Execution Vulnerability

MS16-116 – Security Update in OLE Automation for VBScript Scripting Engine

This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if an attacker successfully convinces a user of an affected system to visit a malicious or compromised website.

Severity: Critical 

Affected Software

  • Windows Vista SP2
  • Windows Server 2008 SP2 and Windows Server 2008 R2 SP1
  • Windows 7 SP1
  • Windows 8.1
  • Windows Server 2012 and Windows Server 2012 R2
  • Windows RT 8.1
  • Windows 10

    CVE-2016-3375 – Scripting Engine Information Disclosure Vulnerability