Zscaler, working with Microsoft through their MAPP program, has proactively deployed protection for the following 10 vulnerabilities included in the June 2017 Microsoft security bulletins. Zscaler will continue to monitor exploits associated with all vulnerabilities in the June release and deploy additional protections as necessary.

CVE-2017-8464 – LNK Remote Code Execution Vulnerability

Severity: Critical

Affected Software

Windows 7 SP1
Windows Server 2008 R2
Windows Server 2012
Windows 8.1
Windows Server 2012 R2
Windows 10
Windows Server 2016
Windows Server 2008 SP2

A remote code execution exists in Microsoft Windows that could allow remote code execution if the icon of a specially crafted shortcut is displayed. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. The attacker could present to the user a removable drive that contains a malicious shortcut file and an associated malicious binary. When the user opens this drive, in Windows Explorer, or any other application that parses the icon of the shortcut, the malicious binary will execute code of the attacker’s choice on the target system. The security update addresses the vulnerability by correcting validation of shortcut icon references.

CVE-2017-8465 – Win32k Elevation of Privilege Vulnerability

Severity: Important

Affected Software

Windows 8.1
Windows Server 2012 R2
Windows 10
Windows Server 2016

An elevation of privilege vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. To exploit the vulnerability, an attacker would have to either log on locally to an affected system, or convince a locally authenticated user to execute a specially crafted application. The update addresses the vulnerability by correcting how the Windows kernel-mode driver handles objects in memory and by helping to prevent unintended elevation of privilege from user mode.

CVE-2017-8466 – Windows Cursor Elevation of Privilege Vulnerability

Severity: Important

Affected Software

Windows 8.1
Windows Server 2012 R2
Windows RT 8.1
Windows Server 2016
Windows 10

An elevation of privilege vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. To exploit the vulnerability, an attacker would have to either log on locally to an affected system, or convince a locally authenticated user to execute a specially crafted application. The update addresses the vulnerability by correcting how the Windows kernel-mode driver handles objects in memory.

CVE-2017-8496 – Microsoft Edge Memory Corruption Vulnerability

Severity: Critical

Affected Software

Microsoft Edge on Windows Server 2016
Microsoft Edge on Windows 10

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge, and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by way of enticement in an email or Instant Messenger message, or by getting them to open an attachment sent through email. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The update addresses the vulnerability by modifying how Microsoft Edge handles objects in memory.

CVE-2017-8497 – Microsoft Edge Memory Corruption Vulnerability

Severity: Critical

Affected Software

Microsoft Edge on Windows Server 2016
Microsoft Edge on Windows 10

CVE-2017-8510 – Microsoft Office Remote Code Execution Vulnerability

Severity: Important

Affected Software

Microsoft Office 2007 SP3
Microsoft Office 2010 SP2
Microsoft Office 2013 SP1
Microsoft Office 2016

A remote code execution vulnerability exists in Microsoft Office software when the Office software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. The file could then, for example, take actions on behalf of the logged-on user with the same permissions as the current user. Exploitation of this vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince them to open the specially crafted file. The security update addresses the vulnerability by correcting how Microsoft Office handles files in memory.

CVE-2017-8524 – Scripting Engine Memory Corruption Vulnerability

Severity: Critical

Affected Software

Internet Explorer 11 on Windows 7
Internet Explorer 11 on Windows Server 2008 R2
Internet Explorer 11 on Windows 8.1
Internet Explorer 11 on Windows Server 2012 R2
Internet Explorer 11 on Windows 10
Internet Explorer 11 on Windows Server 2016
Microsoft Edge on Windows 10
Microsoft Edge on Windows Server 2016

A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. In a web-based attack scenario, an attacker could host a specially crafted website designed to exploit the vulnerability through a Microsoft browser and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the browser rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability. The security update addresses the vulnerability by modifying how Microsoft browser JavaScript scripting engines handle objects in memory.

CVE-2017-8529 – Microsoft Browser Information Disclosure Vulnerability

Severity: Important

Affected Software

Internet Explorer 9 on Windows Server 2008
Internet Explorer 11 on Windows 7
Internet Explorer 11 on Windows Server 2008
Internet Explorer 11 on Windows 8.1
Internet Explorer 11 on Windows Server 2012 R2
Internet Explorer 11 on Windows 10
Internet Explorer 11 on Windows Server 2016
Internet Explorer 10 on Windows Server 2012
Microsoft Edge on Windows 10
Microsoft Edge on Windows Server 2016

An information disclosure vulnerability exists when affected Microsoft scripting engines do not properly handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer. In a web-based attack scenario, an attacker could host a website that is used to attempt to exploit the vulnerability. In addition, compromised websites and websites that accept or host user-generated content could contain specially crafted content that could exploit the vulnerability. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could trick a user into clicking a link that takes the user to the attacker's site. An attacker who successfully exploited the vulnerability could potentially read data that was not intended to be disclosed. Note that the vulnerability would not allow an attacker to either execute code or to elevate a user’s rights directly, but the vulnerability could be used to obtain information to further compromise the affected system. The security update addresses the vulnerability by helping to restrict what information is returned to affected Microsoft browsers.

CVE-2017-8543 – Windows Search Remote Code Execution Vulnerability

Severity: Important

Affected Software

Windows 7 SP1
Windows Server 2008 R2
Windows Server 2012
Windows 8.1
Windows Server 2012 R2
Windows 10
Windows Server 2016
Windows Server 2008

A remote code execution vulnerability exists when Windows Search handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit the vulnerability, the attacker could send specially crafted SMB messages to the Windows Search service. An attacker with access to a target computer could exploit this vulnerability to elevate privileges and take control of the computer. Additionally, in an enterprise scenario, a remote authenticated attacker could remotely trigger the vulnerability through an SMB connection and then take control of a target computer. The security update addresses the vulnerability by correcting how Windows Search handles objects in memory.

CVE-2017-8547 – Internet Explorer Memory Corruption Vulnerability

Severity: Important

Affected Software

Internet Explorer 11 on Windows 7 SP1
Internet Explorer 11 on Windows Server 2008 R2
Internet Explorer 11 on Windows 8.1
Internet Explorer 11 on Windows Server 2012 R2
Internet Explorer 11 on Windows RT 8.1
Internet Explorer 11 on Windows 10
Internet Explorer 11 on Windows Server 2012

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. This vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer, and then convince a user to view the website. The attacker could also take advantage of compromised websites, and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability. The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory.