MS16-048: Description of the security update for CSRSS: April 12, 2016

Applies To
Windows Server 2012 R2 Datacenter Windows Server 2012 R2 Standard Windows Server 2012 R2 Essentials Windows Server 2012 R2 Foundation Windows 8.1 Enterprise Windows 8.1 Pro Windows 8.1 Windows RT 8.1 Windows Server 2012 Datacenter Windows Server 2012 Datacenter Windows Server 2012 Standard Windows Server 2012 Standard Windows Server 2012 Essentials Windows Server 2012 Foundation Windows Server 2012 Foundation

Summary

This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow security feature bypass if an attacker logs on to a target system and runs a specially crafted application.

To learn more about the vulnerability, see Microsoft Security Bulletin MS16-048.

More Information

Important

  • All future security and non-security updates for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 require update 2919355 to be installed. We recommend that you install update 2919355 on your Windows RT 8.1-based, Windows 8.1-based, or Windows Server 2012 R2-based computer so that you receive future updates.
  • If you install a language pack after you install this update, you must reinstall this update. Therefore, we recommend that you install any language packs that you need before you install this update. For more information, see Add language packs to Windows.

Known issues in this security update

  • After installing this security update, some systems that are running third party software may display a 0x00000100 Stop error message after the computer is restarted.

     This problem may occur if the third party software has replaced the winload.exe file. Software that is known to do this includes imaging software from StorageCraft.

    Contact the manufacturer of you software for more information about how to resolve this problem.

    The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

How to obtain and install the update

Method 1: Windows Update

This update is available through Windows Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, see
Get security updates automatically.

Note For Windows RT 8.1, this update is available through Windows Update only.

Method 2: Microsoft Download Center

You can obtain the stand-alone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.

Click the download link in Microsoft Security Bulletin MS16-048 that corresponds to the version of Windows that you are running.

How to obtain help and support for this security update

Help for installing updates: Support for Microsoft Update

Security solutions for IT professionals: TechNet Security Troubleshooting and Support

Help for protecting your Windows-based computer from viruses and malware: Virus Solution and Security Center

Local support according to your country: International Support

File Information

File hash information
File name SHA1 hash SHA256 hash
Windows8.1-KB3146723-x64.msu 5AAE2A7642E87B2881D7337EF736EAEE679F907A 7419BA7ECB7BCD962ECE7AEF269BEE633F6CBC4F4778D5F23CD3C7F7E8FC270F
Windows8.1-KB3146723-x86.msu 5F3689532BF8969D68F21B7B3F82B111F8232F43 4FD9572130014B0AE6A075AC0DB772CEB350EBD385C867E4AB71642F39EC29EE
Windows8-RT-KB3146723-x64.msu 682AE0931C3FA2AFA4E988B8FD08249F15E1D977 06D3E3F90C3863E7A970757446DD87CC47C5EF7F08F406F9B49FF5C988158D86
Windows8-RT-KB3146723-x64_New58.msu B629DB9F3EBB85B40A61A1CC5DEA13C11A124B6C DB652213B70BA0D0CC19ADD967BA933465FE76FD0C74D785458CB8172461B6E0

      

File information

The English (United States) version of this software update installs files that have the attributes that are listed in the following tables.

Windows 8.1 and Windows Server 2012 R2 file information

Notes

  • The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:

    Version Product Milestone Service branch
    6.3.960 0.17 xxx Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 RTM GDR
  • GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.

  • The MANIFEST files (.manifest) and MUM files (.mum) that are installed are not listed.

For all supported x64-based versions

File name File version File size Date Time Platform Service branch
Chs_boot.ttf Not applicable 3,695,655 03-Mar-2016 19:28 Not applicable Not applicable
Msyhn_boot.ttf Not applicable 150,727 03-Mar-2016 19:28 Not applicable Not applicable
Msyh_boot.ttf Not applicable 154,833 03-Mar-2016 19:28 Not applicable Not applicable
Cht_boot.ttf Not applicable 3,878,347 03-Mar-2016 19:28 Not applicable Not applicable
Msjhn_boot.ttf Not applicable 161,491 03-Mar-2016 19:28 Not applicable Not applicable
Msjh_boot.ttf Not applicable 163,498 03-Mar-2016 19:28 Not applicable Not applicable
Segmono_boot.ttf Not applicable 44,623 03-Mar-2016 19:28 Not applicable Not applicable
Segoen_slboot.ttf Not applicable 85,691 03-Mar-2016 19:28 Not applicable Not applicable
Segoe_slboot.ttf Not applicable 86,007 03-Mar-2016 19:28 Not applicable Not applicable
Wgl4_boot.ttf Not applicable 49,027 03-Mar-2016 19:28 Not applicable Not applicable
Jpn_boot.ttf Not applicable 1,985,803 03-Mar-2016 19:28 Not applicable Not applicable
Meiryon_boot.ttf Not applicable 141,491 03-Mar-2016 19:28 Not applicable Not applicable
Meiryo_boot.ttf Not applicable 143,108 03-Mar-2016 19:28 Not applicable Not applicable
Kor_boot.ttf Not applicable 2,372,935 03-Mar-2016 19:28 Not applicable Not applicable
Malgunn_boot.ttf Not applicable 174,367 03-Mar-2016 19:28 Not applicable Not applicable
Malgun_boot.ttf Not applicable 176,812 03-Mar-2016 19:28 Not applicable Not applicable
Winload.efi 6.3.9600.18258 1,663,192 03-Mar-2016 19:27 Not applicable Not applicable
Winload.exe 6.3.9600.18258 1,523,216 03-Mar-2016 19:27 x64 Not applicable
Winresume.efi 6.3.9600.18258 1,490,128 03-Mar-2016 19:27 Not applicable Not applicable
Winresume.exe 6.3.9600.18258 1,358,960 03-Mar-2016 19:27 x64 Not applicable
Basesrv.dll 6.3.9600.18258 59,392 03-Mar-2016 16:13 x64 Not applicable
Csrsrv.dll 6.3.9600.17933 59,392 13-Jul-2015 19:46 x64 Not applicable
Ntdll.dll 6.3.9600.18258 1,737,088 03-Mar-2016 19:27 x64 Not applicable
Ntoskrnl.exe 6.3.9600.18258 7,452,512 03-Mar-2016 19:28 x64 Not applicable
Microsoft-windows-system-events.dll 6.3.9600.18258 246,784 03-Mar-2016 18:29 x64 Not applicable
Krnlprov.dll 6.3.9600.18258 46,592 03-Mar-2016 18:06 x64 Not applicable
Krnlprov.mof Not applicable 14,840 22-Aug-2013 06:51 Not applicable Not applicable
Ntvdm64.dll 6.3.9600.18146 16,896 21-Nov-2015 18:32 x64 AMD64_MICROSOFT-WINDOWS-WOW
Wow64.dll 6.3.9600.17734 285,184 20-Mar-2015 04:10 x64 AMD64_MICROSOFT-WINDOWS-WOW
Wow64cpu.dll 6.3.9600.17734 13,312 20-Mar-2015 04:10 x64 AMD64_MICROSOFT-WINDOWS-WOW
Ntdll.dll 6.3.9600.18258 1,501,496 03-Mar-2016 18:38 x86 Not applicable
Acwow64.dll 6.3.9600.17734 37,376 20-Mar-2015 03:06 x86 WOW64_MICROSOFT-WINDOWS-WOW
Instnm.exe 6.3.9600.17475 8,704 29-Oct-2014 01:13 x86 WOW64_MICROSOFT-WINDOWS-WOW
Ntvdm64.dll 6.3.9600.18146 14,336 21-Nov-2015 17:50 x86 WOW64_MICROSOFT-WINDOWS-WOW
Setup16.exe 3.1.0.1918 25,600 29-Oct-2014 01:13 x86 WOW64_MICROSOFT-WINDOWS-WOW
User.exe 6.3.9600.17475 4,096 29-Oct-2014 01:14 x86 WOW64_MICROSOFT-WINDOWS-WOW
Wow32.dll 6.3.9600.17475 5,632 29-Oct-2014 01:15 x86 WOW64_MICROSOFT-WINDOWS-WOW

For all supported x86-based versions

File name File version File size Date Time Platform
Chs_boot.ttf Not applicable 3,695,658 03-Mar-2016 18:43 Not applicable
Msyhn_boot.ttf Not applicable 150,730 03-Mar-2016 18:43 Not applicable
Msyh_boot.ttf Not applicable 154,831 03-Mar-2016 18:43 Not applicable
Cht_boot.ttf Not applicable 3,878,350 03-Mar-2016 18:43 Not applicable
Msjhn_boot.ttf Not applicable 161,495 03-Mar-2016 18:43 Not applicable
Msjh_boot.ttf Not applicable 163,499 03-Mar-2016 18:43 Not applicable
Segmono_boot.ttf Not applicable 44,623 03-Mar-2016 18:43 Not applicable
Segoen_slboot.ttf Not applicable 85,688 03-Mar-2016 18:43 Not applicable
Segoe_slboot.ttf Not applicable 86,007 03-Mar-2016 18:43 Not applicable
Wgl4_boot.ttf Not applicable 49,024 03-Mar-2016 18:39 Not applicable
Jpn_boot.ttf Not applicable 1,985,803 03-Mar-2016 18:43 Not applicable
Meiryon_boot.ttf Not applicable 141,491 03-Mar-2016 18:43 Not applicable
Meiryo_boot.ttf Not applicable 143,111 03-Mar-2016 18:43 Not applicable
Kor_boot.ttf Not applicable 2,372,935 03-Mar-2016 18:43 Not applicable
Malgunn_boot.ttf Not applicable 174,367 03-Mar-2016 18:43 Not applicable
Malgun_boot.ttf Not applicable 176,815 03-Mar-2016 18:43 Not applicable
Winload.efi 6.3.9600.18258 1,396,696 03-Mar-2016 18:38 Not applicable
Winload.exe 6.3.9600.18258 1,285,608 03-Mar-2016 18:38 x86
Winresume.efi 6.3.9600.18258 1,272,192 03-Mar-2016 18:38 Not applicable
Winresume.exe 6.3.9600.18258 1,172,000 03-Mar-2016 18:38 x86
Basesrv.dll 6.3.9600.18258 50,688 03-Mar-2016 16:11 x86
Csrsrv.dll 6.3.9600.17933 48,640 13-Jul-2015 19:27 x86
Ntdll.dll 6.3.9600.18258 1,471,552 03-Mar-2016 18:38 x86
Ntoskrnl.exe 6.3.9600.18258 5,764,448 03-Mar-2016 18:43 Not applicable
Microsoft-windows-system-events.dll 6.3.9600.18258 246,784 03-Mar-2016 17:49 x86
Krnlprov.dll 6.3.9600.18258 38,912 03-Mar-2016 17:30 x86
Krnlprov.mof Not applicable 14,840 21-Aug-2013 23:46 Not applicable

Windows Server 2012 file information

Notes

  • The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:

    Version Product Milestone Service branch
    6.2.920 0.17xxx Windows 8, Windows RT, or Windows Server 2012 RTM GDR
    6.2.920 0.21xxx Windows 8, Windows RT, or Windows Server 2012 RTM LDR
  • GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.

  • The MANIFEST files (.manifest) and MUM files (.mum) that are installed are not listed.

For all supported x64-based versions

File name File version File size Date Time Platform
Basesrv.dll 6.2.9200.21793 54,272 03-Mar-2016 21:48 x64

For all supported x64-based versions

File name File version File size Date Time Platform SP requirement Service branch
Advapi32.dll 6.2.9200.21820 895,488 29-Mar-2016 21:47 x64 None Not applicable
Winload.efi 6.2.9200.21638 1,405,408 22-Sep-2015 21:46 Not applicable None Not applicable
Winload.exe 6.2.9200.21638 1,273,184 22-Sep-2015 21:46 x64 None Not applicable
Winresume.efi 6.2.9200.20726 1,217,352 25-May-2013 00:17 Not applicable None Not applicable
Winresume.exe 6.2.9200.20726 1,093,904 25-May-2013 00:17 x64 None Not applicable
Basesrv.dll 6.2.9200.21820 54,272 29-Mar-2016 21:47 x64 None Not applicable
Csrsrv.dll 6.2.9200.21548 48,128 11-Jul-2015 18:07 x64 None Not applicable
Ksecdd.sys 6.2.9200.21473 100,184 02-May-2015 06:23 x64 None Not applicable
Lsass.exe 6.2.9200.20521 35,840 20-Sep-2012 06:33 x64 None Not applicable
Sspicli.dll 6.2.9200.21703 164,352 17-Nov-2015 08:00 x64 None Not applicable
Sspisrv.dll 6.2.9200.20521 27,648 20-Sep-2012 06:32 x64 None Not applicable
Cng.sys 6.2.9200.21637 566,072 22-Sep-2015 13:43 x64 None Not applicable
Ksecpkg.sys 6.2.9200.21703 171,352 17-Nov-2015 09:52 x64 None Not applicable
Lsasrv.dll 6.2.9200.21820 1,280,000 29-Mar-2016 21:48 x64 None Not applicable
Adtschema.dll 6.2.9200.21289 719,360 10-Nov-2014 04:43 x64 None Not applicable
Msaudite.dll 6.2.9200.21269 146,944 11-Oct-2014 05:38 x64 None Not applicable
Msobjs.dll 6.2.9200.16384 61,952 26-Jul-2012 02:36 x64 None Not applicable
Ntdll.dll 6.2.9200.21820 1,821,704 30-Mar-2016 01:32 x64 None Not applicable
Ocspsvcctrs.ini Not applicable 2,960 26-Jul-2012 05:07 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.ini Not applicable 3,134 26-Jul-2012 08:00 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.ini Not applicable 2,918 26-Jul-2012 04:43 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.ini Not applicable 3,210 26-Jul-2012 07:59 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.ini Not applicable 3,098 26-Jul-2012 08:00 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.ini Not applicable 3,028 26-Jul-2012 07:59 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.ini Not applicable 3,140 26-Jul-2012 05:21 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.ini Not applicable 2,642 26-Jul-2012 08:11 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.ini Not applicable 2,576 26-Jul-2012 05:20 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.ini Not applicable 3,026 26-Jul-2012 07:36 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.ini Not applicable 3,028 26-Jul-2012 07:48 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.ini Not applicable 3,188 26-Jul-2012 05:30 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.ini Not applicable 3,126 26-Jul-2012 05:08 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.ini Not applicable 3,064 26-Jul-2012 07:49 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.ini Not applicable 3,092 26-Jul-2012 07:52 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.ini Not applicable 2,828 26-Jul-2012 05:12 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.ini Not applicable 2,464 26-Jul-2012 08:05 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.ini Not applicable 2,480 26-Jul-2012 05:13 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.ini Not applicable 2,460 26-Jul-2012 08:11 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvc.exe 6.2.9200.21345 272,384 15-Jan-2015 05:27 x64 SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.h Not applicable 1,569 02-Jun-2012 14:34 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ocspsvcctrs.ini Not applicable 2,918 02-Jun-2012 14:34 Not applicable SPS AMD64_MICROSOFT-WINDOWS-OCSP
Ntoskrnl.exe 6.2.9200.21821 6,938,464 30-Mar-2016 01:34 x64 None Not applicable
Credssp.dll 6.2.9200.21703 20,480 17-Nov-2015 07:59 x64 SP_ AMD64_MICROSOFT-WINDOWS-SECURITY-CREDSSP
Tspkg.dll 6.2.9200.21703 94,720 17-Nov-2015 08:01 x64 SP_ AMD64_MICROSOFT-WINDOWS-SECURITY-CREDSSP
Tspkg.mof Not applicable 964 02-Jun-2012 14:33 Not applicable SP_ AMD64_MICROSOFT-WINDOWS-SECURITY-CREDSSP
Wdigest.dll 6.2.9200.21703 208,896 17-Nov-2015 08:01 x64 None Not applicable
Kerberos.dll 6.2.9200.21820 830,464 29-Mar-2016 21:48 x64 None Not applicable
Msv1_0.dll 6.2.9200.21820 317,952 29-Mar-2016 21:48 x64 None Not applicable
Shcore.dll 6.2.9200.21703 590,848 17-Nov-2015 08:00 x64 None Not applicable
Mrxsmb10.sys 6.2.9200.21529 281,600 25-Jun-2015 18:52 x64 None Not applicable
Mrxsmb20.sys 6.2.9200.21548 205,312 11-Jul-2015 17:07 x64 None Not applicable
Mrxsmb.sys 6.2.9200.21342 396,800 06-Jan-2015 23:17 x64 None Not applicable
Lsm.dll 6.2.9200.21703 439,808 17-Nov-2015 08:00 x64 None Not applicable
Workerdd.dll 6.2.9200.21012 14,848 12-Apr-2014 06:58 x64 None Not applicable
Usercpl.dll 6.2.9200.21703 1,043,968 17-Nov-2015 08:01 x64 None Not applicable
Usercpl.ptxml Not applicable 789 11-Oct-2012 00:40 Not applicable None Not applicable
Winlogon.exe 6.2.9200.21703 578,048 17-Nov-2015 08:01 x64 None Not applicable
Sspicli.dll 6.2.9200.20984 99,840 10-Mar-2014 01:34 x86 None Not applicable
Ntdll.dll 6.2.9200.21821 1,413,120 30-Mar-2016 00:14 x86 None Not applicable
Wdigest.dll 6.2.9200.21703 176,640 17-Nov-2015 08:09 x86 None Not applicable
Kerberos.dll 6.2.9200.21821 666,624 29-Mar-2016 23:58 x86 None Not applicable
Msv1_0.dll 6.2.9200.21821 274,944 29-Mar-2016 23:58 x86 None Not applicable
Advapi32.dll 6.2.9200.21821 704,000 29-Mar-2016 23:57 x86 None Not applicable
Adtschema.dll 6.2.9200.21289 719,360 10-Nov-2014 03:40 x86 None Not applicable
Msaudite.dll 6.2.9200.21269 146,944 11-Oct-2014 04:35 x86 None Not applicable
Msobjs.dll 6.2.9200.16384 61,952 26-Jul-2012 02:47 x86 None Not applicable
Credssp.dll 6.2.9200.21703 17,408 17-Nov-2015 08:08 x86 SP_ X86_MICROSOFT-WINDOWS-SECURITY-CREDSSP
Tspkg.dll 6.2.9200.21703 76,800 17-Nov-2015 08:09 x86 SP_ X86_MICROSOFT-WINDOWS-SECURITY-CREDSSP
Tspkg.mof Not applicable 964 02-Jun-2012 14:33 Not applicable SP_ X86_MICROSOFT-WINDOWS-SECURITY-CREDSSP
Shcore.dll 6.2.9200.21703 460,800 17-Nov-2015 08:09 x86 None Not applicable
Usercpl.dll 6.2.9200.21703 961,536 17-Nov-2015 08:09 x86 None Not applicable
Usercpl.ptxml Not applicable 789 11-Oct-2012 00:42 Not applicable None Not applicable