TACERT台灣學術網路危機處理中心

※安全通報資訊

安全通報類型	微軟安全通報
發佈日期	2015-07-14
標題	Microsoft Security Bulletin MS15-069 - Important-Vulnerabilities in Windows Could Allow Remote Code Execution
CVE	CVE-2015-2368;CVE-2015-2369
BID
影響平台	This security update is rated Important for all supported editions of Windows Server 2003 (excluding Itanium), Windows Vista, Windows Server 2008 (excluding Itanium), Windows 7, Windows Server 2008 R2 (excluding Itanium), Windows 8.1, Windows 2012 R2, and Windows RT 8.1. For more information
說明	This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow Remote Code Execution if an attacker first places a specially crafted dynamic link library (DLL) file in the target user’s current working directory and then convinces the user to open an RTF file or to launch a program that is designed to load a trusted DLL file but instead loads the attacker’s specially crafted DLL file. An attacker who successfully exploited the vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
解決方式	大部分客戶都已啟用自動更新，並且不必須採取任何行動，因為資訊安全更新將自動下載和安裝。對於沒有啟用自動更新的客戶，可採取開啟或關閉自動更新中的步驟來啟用自動更新。
相關資訊連結	https://technet.microsoft.com/zh-TW/library/security/ms15-069.aspx
相關修正資訊連結	https://technet.microsoft.com/zh-TW/library/security/ms15-069.aspx