MS15-084 - K7 Labs

<< Back

CVE Number	Vulnerability	Product	Severity	Date
MS15-084	Vulnerabilities in XML Core Services Could Allow Information Disclosure (3080129)	Windows Vista	Important	12-08-2015

Technical Information

Brief overview of the risk:
The vulnerabilities could allow information disclosure by either exposing memory addresses if a user clicks a specially crafted link or by explicitly allowing the use of Secure Sockets Layer (SSL) 2.0. However, in all cases an attacker would have no way to force users to click a specially crafted link. An attacker would have to convince users to click the link, typically by way of an enticement in an email or Instant Messenger message.

Detailed Information on the risk:

Information disclosure vulnerabilities exist when Microsoft XML Core Services (MSXML) explicitly allows the use of Secure Sockets Layer (SSL) 2.0. An attacker who successfully exploited these vulnerabilities could decrypt portions of encrypted network information traffic.
In a man-in-the-middle (MiTM) attack scenario, an attacker could force an encrypted SSL 2.0 session and then decrypt portions of encrypted network information traffic. This update resolves the issue by configuring MSXML to use more secure network protocols by default instead of SSL 2.0.

Further information on this exploit is available at : MS15-084

Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
Windows 8 for 32-bit Systems
Windows 8 for x64-based Systems
Windows 8.1 for 32-bit Systems
Windows 8.1 for x64-based Systems
Windows Server 2012
Windows Server 2012 R2
Windows 10 for 32-bit Systems
Windows 10 for x64-based Systems
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2(Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1(Server Core installation)
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2 (Server Core installation)

Technical Information

Affected Software