Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and Internet Explorer 10 and 11 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."

The remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability exists in the     Windows kernel due to improper handling of objects in     memory. A local attacker can exploit this, via a crafted     application, to run arbitrary code in kernel mode and     therefore take control of the affected system.
    (CVE-2016-0040)

  - Multiple code execution vulnerabilities exist due to     improper validation of user-supplied input when loading     DLL files. A local attacker can exploit these, via a     specially crafted application, to execute arbitrary     code. (CVE-2016-0041, CVE-2016-0042)

  - A denial of service vulnerability exists in Microsoft     Sync Framework due to improper processing of crafted     input that uses the 'change batch' structure. An     authenticated, remote attacker can exploit this, via     specially crafted packets sent to the SyncShareSvc     service, to cause the service to stop responding.
    (CVE-2016-0044)

  - A security feature bypass vulnerability exists when     Kerberos fails to check the password change of a user     signing into a workstation. An attacker can exploit     this, by connecting the workstation to a malicious     Kerberos Key distribution Center, to bypass Kerberos     authentication on a target machine, thus allowing     decryption of drives protected by BitLocker.
    (CVE-2016-0049)

The version of Internet Explorer installed on the remote host is missing Cumulative Security Update 3134220. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists due to     improper validation of input when loading dynamic link     library (DLL) files. A local attacker can exploit this,     via a specially crafted application, to execute     arbitrary code. (CVE-2016-0041)

  - An information disclosure vulnerability exists in the     Hyperlink Object Library due to improper handling of     objects in memory. A remote attacker can exploit this by     convincing a user to click a link in an email or Office     file, resulting in the disclosure of memory contents.
    (CVE-2016-0059)

  - Multiple remote code execution vulnerabilities exist due     to improper handling of objects in memory. A remote     attacker can exploit these vulnerabilities by convincing     a user to visit a specially crafted website, resulting     in the execution of arbitrary code in the context of the     current user. (CVE-2016-0060, CVE-2016-0061,     CVE-2016-0062, CVE-2016-0063, CVE-2016-0064,     CVE-2016-0067, CVE-2016-0071, CVE-2016-0072)

  - A spoofing vulnerability exists due to improper parsing     of HTTP responses. An unauthenticated, remote attacker     can exploit this, via a specially crafted URL, to     redirect a user to a malicious website. (CVE-2016-0077)

  - Multiple elevation of privilege vulnerabilities exist     due to improper enforcement of cross-domain policies. An     unauthenticated, remote attacker can exploit this by     convincing a user to visit a specially crafted website,     resulting in an elevation of privilege. (CVE-2016-0068,     CVE-2016-0069)

ID	Name	Product	Family	Severity
88646	MS16-014: Security Update for Microsoft Windows to Address Remote Code Execution (3134228)	Nessus	Windows : Microsoft Bulletins	high
88642	MS16-009: Cumulative Security Update for Internet Explorer (3134220)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2016-0041

high

Tenable Plugins

high

high