CVE-2016-3225

Меры по смягчению последствий

The following mitigating factors might be helpful in your situation:

An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability.

Обходное решение

Enable Extended Protection for Authentication (EPA) for SMB server. For customers running Windows Vista and Windows Server 2008: You must have update 968389 installed on both client and server computers. To download the update, see Microsoft Knowledge Base Article 968389. You must also have update 2345886 installed on both client and server computers. If the update is not already installed on your system, you can download it from the Microsoft Update Catalog. After you install update 2345886, the EPA security feature is off by default as it may cause some application compatibility concerns. To enable EPA for SMB clients and servers, see the References section of Microsoft Knowledge Base Article 2345886.

For customers running Windows 7 and Windows Server 2008 R2: You must have update 2345886 installed on both client and server computers. If the update is not already installed on your system, you can download it from the Microsoft Update Catalog. After you install the update, the EPA security feature is off by default as it may cause some application compatibility concerns. To enable EPA for SMB clients and servers, see the References section of Microsoft Knowledge Base Article 2345886. Note that the instructions in this article also apply to later releases of Microsoft Windows.

For customers running Windows 8 and later versions of Windows: The EPA security feature is built into the operating system, but is off by default as it may cause some application compatibility concerns. To enable EPA for SMB clients and servers, see the References section of Microsoft Knowledge Base Article 2345886. Note that the instructions in this article also apply to later releases of Microsoft Windows.

FAQ

Why is security update 3161561 in this bulletin also denoted in MS16-076?  Security update 3161561 is also denoted in MS16-076 for supported releases of Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2 due to the way fixes for vulnerabilities affecting particular products are consolidated. Because bulletins are broken out by the vulnerabilities being addressed, not by the update package being released, it is possible for separate bulletins, each addressing distinctly different vulnerabilities, to list the same update package as the vehicle for providing their respective fixes. This is frequently the case with cumulative updates for products, such as Internet Explorer or Silverlight, where singular security updates address different security vulnerabilities in separate bulletins.

Note: Users do not need to install identical security updates that ship with multiple bulletins more than once.