Vulnerabilities > CVE-2016-0145 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Microsoft products

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
microsoft
CWE-119
critical
nessus
exploit available
NVD
Published: 2016-04-12
Updated: 2018-10-12

Summary

The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold and 1511; Office 2007 SP3 and 2010 SP2; Word Viewer; .NET Framework 3.0 SP2, 3.5, and 3.5.1; Skype for Business 2016; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Graphics Memory Corruption Vulnerability."

Vulnerable Configurations

Part Description Count
Application
Microsoft
11
OS
Microsoft
10

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Exploit-Db

descriptionWindows Kernel - win32k.sys TTF Processing EBLC / EBSC Tables Pool Corruption (MS16-039). CVE-2016-0145. Dos exploit for windows platform
fileexploits/windows/dos/39743.txt
idEDB-ID:39743
last seen2016-04-28
modified2016-04-28
platformwindows
port
published2016-04-28
reporterGoogle Security Research
sourcehttps://www.exploit-db.com/download/39743/
titleWindows Kernel - win32k.sys TTF Processing EBLC / EBSC Tables Pool Corruption MS16-039
typedos

Msbulletin

bulletin_idMS16-039
bulletin_url
date2016-04-12T00:00:00
impactRemote Code Execution
knowledgebase_id3148522
knowledgebase_url
severityCritical
titleSecurity Update for Microsoft Graphics Component

Nessus

NASL familyWindows : Microsoft Bulletins
NASL idSMB_NT_MS16-039.NASL
descriptionThe remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities : - Multiple elevation of privilege vulnerabilities exist in the Windows kernel-mode driver due to a failure to properly handle objects in memory. An attacker can exploit these vulnerabilities to execute arbitrary code in kernel mode. (CVE-2016-0143, CVE-2016-0165, CVE-2016-0167) - A remote code execution vulnerability exists in the Windows font library due to improper handling of embedded fonts. An attacker can exploit this vulnerability by convincing a user to open a file or visit a website containing specially crafted embedded fonts, resulting in the execution of arbitrary code in the context of the current user. (CVE-2016-0145)
last seen2020-06-01
modified2020-06-02
plugin id90433
published2016-04-12
reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/90433
titleMS16-039: Security Update for Microsoft Graphics Component (3148522)
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(90433);
  script_version("1.18");
  script_cvs_date("Date: 2019/11/19");

  script_cve_id(
    "CVE-2016-0143",
    "CVE-2016-0145",
    "CVE-2016-0165",
    "CVE-2016-0167"
  );
  script_bugtraq_id(
    85896,
    85899,
    85900,
    85903
  );
  script_xref(name:"MSFT", value:"MS16-039");
  script_xref(name:"MSKB", value:"3145739");
  script_xref(name:"MSKB", value:"3147461");
  script_xref(name:"MSKB", value:"3147458");
  script_xref(name:"MSKB", value:"3114542");
  script_xref(name:"MSKB", value:"3114566");
  script_xref(name:"MSKB", value:"3114985");
  script_xref(name:"MSKB", value:"3142041");
  script_xref(name:"MSKB", value:"3142042");
  script_xref(name:"MSKB", value:"3142045");
  script_xref(name:"MSKB", value:"3142043");
  script_xref(name:"MSKB", value:"3114960");
  script_xref(name:"MSKB", value:"3114944");
  script_xref(name:"MSKB", value:"3144427");
  script_xref(name:"MSKB", value:"3144428");
  script_xref(name:"MSKB", value:"3144429");
  script_xref(name:"MSKB", value:"3144432");
  script_xref(name:"MSKB", value:"4038788");
  script_xref(name:"IAVA", value:"2016-A-0091");

  script_name(english:"MS16-039: Security Update for Microsoft Graphics Component (3148522)");
  script_summary(english:"Checks the version of win32k.sys.");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote Windows host is missing a security update. It is,
therefore, affected by multiple vulnerabilities :
  
  - Multiple elevation of privilege vulnerabilities exist in
    the Windows kernel-mode driver due to a failure to
    properly handle objects in memory. An attacker can
    exploit these vulnerabilities to execute arbitrary code
    in kernel mode. (CVE-2016-0143, CVE-2016-0165,
    CVE-2016-0167)

  - A remote code execution vulnerability exists in the
    Windows font library due to improper handling of
    embedded fonts. An attacker can exploit this
    vulnerability by convincing a user to open a file or
    visit a website containing specially crafted embedded
    fonts, resulting in the execution of arbitrary code in
    the context of the current user. (CVE-2016-0145)");
  script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2016/ms16-039");
  script_set_attribute(attribute:"solution", value:
"Microsoft has released a set of patches for Windows Vista, 2008, 7,
2008 R2, 2012, 8.1, RT 8.1, 2012 R2, and 10. Additionally, Microsoft
has released a set of patches for Office 2007, Office 2010,
Word Viewer, Skype for Business 2016, Lync 2010, Lync 2013, Live
Meeting 2007 Console, .NET framework 3.0 SP2, .NET framework 3.5, and
.NET framework 3.5.1.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-0145");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/04/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/04/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/04/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:word_viewer");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:.net_framework");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:skype_for_business");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:lync");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:lync_basic");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:lync_attendee");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:live_meeting_console");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl", "office_installed.nasl", "microsoft_lync_server_installed.nasl", "microsoft_net_framework_installed.nasl", "smb_check_rollup.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, "Host/patch_management_checks");

  exit(0);
}

include("audit.inc");
include("smb_hotfixes_fcheck.inc");
include("smb_hotfixes.inc");
include("smb_func.inc");
include("misc_func.inc");
include("install_func.inc");

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = 'MS16-039';
kbs = make_list(
  "3145739", # Not Windows 10
  "3147461", # Windows 10 1511
  "3147458", # Windows 10 TRM
  "3114542", # Office 2007 SP3
  "3114566", # Office 2010 SP2
  "3114985", # Office Word Viewer
  "3142041", # .NET 3.0 SP2 Visa / 2008
  "3142042", # .NET 3.5.1 7 / 2008 R2 
  "3142045", # .NET 3.5 8.1 / 2012 R2
  "3142043", # .NET 3.5 2012
  "3114960", # Skype for Biz 2016
  "3114944", # Lync 2013
  "3144427", # Lync 2010
  "3144428", # 2010 Attendee (User level)
  "3144429", # 2010 Attendee (Admin level)
  "3144432", # Live meeting 2007 Console
  "4038788" # Windows 10 1703
);

if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);

get_kb_item_or_exit("SMB/Registry/Enumerated");
get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);

productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
if ("Windows 8" >< productname && "8.1" >!< productname)
  audit(AUDIT_OS_SP_NOT_VULN);

if (hotfix_check_sp_range(vista:'2', win7:'1', win8:'0', win81:'0', win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);

share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);

vuln = 0;

#KB 3147458, 3147461, 3145739
function windows_os_is_vuln()
{
  if (
    # 10 (1703)
    smb_check_rollup(os:"10", sp:0, os_build:"15063", rollup_date: "09_2017", bulletin:bulletin, rollup_kb_list:make_list(4038788)) ||

    # 10 threshold 2 (aka 1511)
    hotfix_is_vulnerable(os:"10", sp:0, file:"win32kfull.sys", version:"10.0.10586.212", min_version:"10.0.10586.0", dir:"\system32", bulletin:bulletin, kb:"3147458") ||

    # 10 RTM
    hotfix_is_vulnerable(os:"10", sp:0, file:"win32kfull.sys", version:"10.0.10240.16771", dir:"\system32", bulletin:bulletin, kb:"3147461") ||

    # Windows 8.1 / Windows Server 2012 R2
    hotfix_is_vulnerable(os:"6.3", sp:0, file:"win32k.sys", version:"6.3.9600.18290", min_version:"6.3.9600.16000", dir:"\system32", bulletin:bulletin, kb:"3145739") ||

    # Windows 8 / Windows Server 2012
    hotfix_is_vulnerable(os:"6.2", sp:0, file:"win32k.sys", version:"6.2.9200.21824", min_version:"6.2.9200.16000", dir:"\system32", bulletin:bulletin, kb:"3145739") ||

    # Windows 7 / Server 2008 R2
    hotfix_is_vulnerable(os:"6.1", sp:1, file:"win32k.sys", version:"6.1.7601.23407", min_version:"6.1.7601.16000", dir:"\system32", bulletin:bulletin, kb:"3145739") ||

    # Vista / Windows Server 2008
    hotfix_is_vulnerable(os:"6.0", sp:2, file:"win32k.sys", version:"6.0.6002.19626", min_version:"6.0.6002.16000", dir:"\system32", bulletin:bulletin, kb:"3145739") ||
    hotfix_is_vulnerable(os:"6.0", sp:2, file:"win32k.sys", version:"6.0.6002.23943", min_version:"6.0.6002.23000", dir:"\system32", bulletin:bulletin, kb:"3145739")
  ) vuln += 1;
}

#KB 3114985 , 3114542, 3114566
#Make sure to add dependency for office_installed.nasl
function office_is_vuln()
{
  local_var office_versions, office_sp;
  local_var path;

  office_versions = hotfix_check_office_version();
  if (office_versions["14.0"])
  {
    office_sp = get_kb_item("SMB/Office/2010/SP");
    if (!isnull(office_sp) && office_sp == 2)
    {
      path = hotfix_append_path(path:hotfix_get_officecommonfilesdir(officever:"14.0"), value:"\Microsoft Shared\Office14");
      if (hotfix_check_fversion(file:"Ogl.dll", version:"14.0.7168.5000", min_version:"14.0.0.0", path:path, bulletin:bulletin, kb:"3114566", product:"Microsoft Office 2010 SP2") == HCF_OLDER)
        vuln++;
    }
  }

  # 2007 SP3
  if (office_versions["12.0"])
  {
    office_sp = get_kb_item("SMB/Office/2007/SP");
    if (office_sp == 3)
    {
      path = hotfix_append_path(path:hotfix_get_officecommonfilesdir(officever:"12.0"), value:"\Microsoft Shared\Office12");
      if (hotfix_check_fversion(file:"Ogl.dll", version:"12.0.6746.5000", min_version:"12.0.0.0", path:path, bulletin:bulletin, kb:'3114542', product:"Microsoft Office 2007 SP3") == HCF_OLDER)
         vuln++;
    }
  }

  # Word Viewer
  if (!empty_or_null(get_kb_list("SMB/Office/WordViewer/*/ProductPath")))
  {
    path = hotfix_append_path(path:hotfix_get_officecommonfilesdir(officever:"11.0"), value:"Microsoft Shared\Office11");
    if (hotfix_check_fversion(file:"gdiplus.dll", version:"11.0.8426.0", min_version:"11.0.0.0", path:path, bulletin:bulletin, kb:'3114985', product:"Microsoft Word Viewer") == HCF_OLDER)
      vuln++;
  }
}

#KB 3114960, 3114944, 3144427, 3144428, 3144429, 3144432 Lync checks
#Make sure to add dependency for microsoft_lync_server_installed.nasl
function lync_is_vuln()
{
  local_var lync_count, lync_installs, lync_install;

  lync_count = get_install_count(app_name:"Microsoft Lync");

  # Nothing to do
  if (int(lync_count) <= 0)
    return FALSE;

  lync_installs = get_installs(app_name:"Microsoft Lync");
  foreach lync_install (lync_installs[1])
  {
    if ("Live Meeting 2007 Console" >< lync_install["Product"])
    {
     if (hotfix_check_fversion(file:"pubutil.dll", version:"8.0.6362.252", min_version:"8.0.0.0", path:lync_install["path"], bulletin:bulletin, kb:"3144432", product:"Live Meeting 2007 Console") == HCF_OLDER)
       vuln++;
    }
    if (lync_install["version"] =~ "^4\.0\." && "Server" >!< lync_install["Product"])
    {
      # Lync 2010
      if ("Attendee" >!< lync_install["Product"])
      {
        if (hotfix_check_fversion(file:"communicator.exe", version:"4.0.7577.4500", min_version:"4.0.0.0", path:lync_install["path"], bulletin:bulletin, kb:"3144427", product:"Microsoft Lync 2010") == HCF_OLDER)
          vuln++;
      }
      # Lync 2010 Attendee
      else if ("Attendee" >< lync_install["Product"])
      {
        if ("user level" >< tolower(lync_install["Product"])) # User
        {
          if (hotfix_check_fversion(file:"MeetingJoinAxAOC.DLL", version:"4.0.7577.4498", min_version:"4.0.0.0", path:lync_install["path"], bulletin:bulletin, kb:"3144428", product:lync_install["Product"]) == HCF_OLDER)
            vuln++;
        }
        else # Admin
        {
          if (hotfix_check_fversion(file:"MeetingJoinAxAOC.DLL", version:"4.0.7577.4498", min_version:"4.0.0.0", path:lync_install["path"], bulletin:bulletin, kb:"3144429", product:lync_install["Product"]) == HCF_OLDER)
            vuln++;
        }
      }
    }
    # Lync 2013
    else if (lync_install["version"] =~ "^15\.0\." && "Server" >!< lync_install["Product"])
    {
      if (hotfix_check_fversion(file:"Lync.exe", version:"15.0.4809.1000", min_version:"15.0.4569.1503", path:lync_install["path"], bulletin:bulletin, kb:"3114944", product:"Microsoft Lync 2013 (Skype for Business)") == HCF_OLDER)
        vuln++;
    }
    # Skype for Business 2016
    else if (lync_install["version"] =~ "^16\.0\." && "Server" >!< lync_install["Product"])
    {
      # Office 365 Deferred channel
      if (hotfix_check_fversion(file:"Lync.exe", version:"16.0.6001.1073", channel:"Deferred", channel_product:"Lync", path:lync_install["path"], bulletin:bulletin, kb:"3114960", product:"Skype for Business 2016") == HCF_OLDER)
        vuln++;
      # Office 365 First Release for Deferred channel
      if (hotfix_check_fversion(file:"Lync.exe", version:"16.0.6741.2026", channel:"First Release for Deferred", channel_product:"Lync", path:lync_install["path"], bulletin:bulletin, kb:"3114960", product:"Skype for Business 2016") == HCF_OLDER)
        vuln++;
      # Office 365 Current channel
      if (hotfix_check_fversion(file:"Lync.exe", version:"16.0.6769.2017", channel:"Current", channel_product:"Lync", path:lync_install["path"], bulletin:bulletin, kb:"3114960", product:"Skype for Business 2016") == HCF_OLDER)
        vuln++;
      # KB
      if (hotfix_check_fversion(file:"Lync.exe", version:"16.0.4363.1000", channel:"MSI", channel_product:"Lync", path:lync_install["path"], bulletin:bulletin, kb:"3114960", product:"Skype for Business 2016") == HCF_OLDER)
        vuln++;
    }
  }
}

#KB 3142041, 3142042, 3142043, 3142045
# Make sure to add dependency for microsoft_net_framework_installed.nasl
function dotnet_is_vuln()
{
  local_var dotnet_452_installed, dotnet_46_installed, dotnet_461_installed, dotnet_35_installed;
  local_var ver, missing, count, installs, install;

  # Determine if .NET 4.5.2 or 4.6 is installed
  dotnet_452_installed = FALSE;
  dotnet_46_installed  = FALSE;
  dotnet_461_installed = FALSE;
  dotnet_35_installed  = FALSE;

  count = get_install_count(app_name:'Microsoft .NET Framework');
  if (count > 0)
  {
    installs = get_installs(app_name:'Microsoft .NET Framework');
    foreach install(installs[1])
    {
      ver = install["version"];
      if (ver == "4.6.1") dotnet_461_installed = TRUE;
      if (ver == "4.6") dotnet_46_installed = TRUE;
      if (ver == "4.5.2") dotnet_452_installed = TRUE;
      if (ver == "3.5") dotnet_35_installed = TRUE;
    }
  }


  ############ KB3142041 ############
  # .NET Framework 3.0              #
  # Windows Vista                   #
  # Windows 2008                    #
  ###################################
  missing = 0;
  missing += hotfix_is_vulnerable(os:"6.0", sp:2, file:"wpfgfx_v0300.dll", version:"3.0.6920.4235", min_version:"3.0.6920.0", dir:"\Microsoft.NET\Framework\v3.0\WPF");
  missing += hotfix_is_vulnerable(os:"6.0", sp:2, file:"wpfgfx_v0300.dll", version:"3.0.6920.8712", min_version:"3.0.6920.7000", dir:"\Microsoft.NET\Framework\v3.0\WPF");

  if (missing > 0) hotfix_add_report(bulletin:bulletin, kb:"3142041");
  vuln += missing;


  ########### KB3142042 #############
  # .NET Framework 3.5.1            #
  # Windows 7 SP1                   #
  # Windows Server 2008 R2 SP1      #
  ###################################
  missing = 0;
  missing += hotfix_is_vulnerable(os:"6.1", sp:1, file:"wpfgfx_v0300.dll", version:"3.0.6920.8712", min_version:"3.0.6920.0",    dir:"\Microsoft.NET\Framework\v3.0\WPF");

  if (missing > 0) hotfix_add_report(bulletin:bulletin, kb:"3142042");
  vuln += missing;


  ########### KB3142045 ###########
  # .NET Framework 3.5            #
  # Windows 8.1                   #
  # Windows Server 2012 R2        #
  #################################
  missing = 0;
  missing += hotfix_is_vulnerable(os:"6.3", sp:0, file:"wpfgfx_v0300.dll", version:"3.0.6920.8712", min_version:"3.0.6920.0",    dir:"\Microsoft.NET\Framework\v3.0\WPF");

  if (missing > 0) hotfix_add_report(bulletin:bulletin, kb:"3142045");
  vuln += missing;


  ############ KB3142043 ############
  # .NET Framework 3.5              #
  # Windows Server 2012             #
  ###################################
  missing = 0;
  missing += hotfix_is_vulnerable(os:"6.2", sp:0, file:"wpfgfx_v0300.dll", version:"3.0.6920.8712", min_version:"3.0.6920.0",    dir:"\Microsoft.NET\Framework\v3.0\WPF");

  if (missing > 0) hotfix_add_report(bulletin:bulletin, kb:"3142043");
  vuln += missing;

  ############# KB3147458 #############
  #  .NET Framework 3.5               #
  #  Windows 10                       #
  #####################################
  missing = 0;
  # .NET 3.5
  missing += hotfix_is_vulnerable(os:"10", sp:0, file:"wpfgfx_v0300.dll", version:"3.0.6920.8712", min_version:"3.0.6920.0", dir:"\Microsoft.NET\Framework\v3.0\WPF");

  if (missing > 0) hotfix_add_report(bulletin:bulletin, kb:"3147458");
  vuln += missing;
}

dotnet_is_vuln();
office_is_vuln();
lync_is_vuln();
windows_os_is_vuln();

if (vuln > 0)
{
  set_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
  hotfix_security_hole();
  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, 'affected');
}

References