MS15-117: Security update for NDIS to address elevation of privilege: November 10, 2015

Summary

This security update resolves a vulnerability in Microsoft Windows NDIS. The vulnerability could allow elevation of privilege if an attacker logs on to a system and runs a specially crafted application.

To learn more about the vulnerability, see Microsoft Security Bulletin MS15-117.

More Information

Important

  • If you install a language pack after you install this update, you must reinstall this update. Therefore, we recommend that you install any language packs that you need before you install this update. For more information, see Add language packs to Windows.

How to obtain and install the update

Method 1: Windows Update

This update is available through Windows Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, see
Get security updates automatically.

You can obtain the stand-alone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.

Click the download link in Microsoft Security Bulletin MS15-117 that corresponds to the version of Windows that you are running.

More Information

Windows Vista (all editions)Reference table

The following table contains the security update information for this software.

Security update file names

For all supported 32-bit editions of Windows Vista:
Windows6.0-KB3101722-x86.msu


For all supported x64-based editions of Windows Vista:
Windows6.0-KB3101722-x64.msu

Installation switches

See Microsoft Knowledge Base Article 934307

Restart requirement

A system restart is required after you apply this security update.

Removal information

WUSA.exe does not support uninstall of updates. To uninstall an update that is installed by WUSA, click Control Panel, and then click Security. Under Windows Update, click View installed updates, and then select from the list of updates.

File information

See the file information section.

Registry key verification

Note A registry key does not exist to validate the presence of this update.

Windows Server 2008 (all editions)Reference table

The following table contains the security update information for this software.

Security update file names

For all supported 32-bit editions of Windows Server 2008:
Windows6.0-KB3101722-x86.msu


For all supported x64-based editions of Windows Server 2008:
Windows6.0-KB3101722-x64.msu


For all supported Itanium-based editions of Windows Server 2008:
Windows6.0-KB3101722-ia64.msu

Installation switches

See Microsoft Knowledge Base Article 934307

Restart requirement

A system restart is required after you apply this security update.

Removal information

WUSA.exe does not support uninstall of updates. To uninstall an update that is installed by WUSA, click Control Panel, and then click Security. Under Windows Update, click View installed updates, and then select from the list of updates.

File information

See the file information section.

Registry key verification

Note A registry key does not exist to validate the presence of this update.

Windows 7 (all editions)
Reference table

The following table contains the security update information for this software.

Security update file name

For all supported 32-bit editions of Windows 7:
Windows6.1-KB3101722-x86.msu


For all supported x64-based editions of Windows 7:
Windows6.1-KB3101722-x64.msu

Installation switches

See Microsoft Knowledge Base Article 934307

Restart requirement

A system restart is required after you apply this security update.

Removal information

To uninstall an update that is installed by WUSA, use the /Uninstall setup switch. Or, click Control Panel, and then click System and Security. Under Windows Update, click View installed updates, and then select from the list of updates.

File information

See the file information section.

Registry key verification

Note A registry key does not exist to validate the presence of this update.

Windows Server 2008 R2 (all editions)Reference table

The following table contains the security update information for this software.

Security update file name

For all supported x64-based editions of Windows Server 2008 R2:
Windows6.1-KB3101722-x64.msu


For all supported Itanium-based editions of Windows Server 2008 R2:
Windows6.1-KB3101722-ia64.msu

Installation switches

See Microsoft Knowledge Base Article 934307

Restart requirement

A system restart is required after you apply this security update.

Removal information

To uninstall an update that is installed by WUSA, use the /Uninstall setup switch. Or, click Control Panel, and then click System and Security. Under Windows Update, click View installed updates, and then select from the list of updates.

File information

See the file information section.

Registry key verification

Note A registry key does not exist to validate the presence of this update.


Package Name

Package Hash SHA 1

Package Hash SHA 2

Windows6.1-KB3101722-x86.msu

5EED9E97A51E766E689E82A6817E839F26C71005

0B122AE4F872847DB517D15EAE97DD3802E04A6AD0CA2BBA460367D3991909C6

Windows6.1-KB3101722-x64.msu

068F82BEA5CF9AB7B2DB99DECC412BD28EF4AED3

8EB13A420438285B40F469E060D3AE675B15497A9EA67C4888226DBA07B749D6

Windows6.0-KB3101722-x86.msu

3594341F8247F2869EF600541B7B73B0B844C30A

90131D544BB25FF236B524AF2593C73C53BA5C676A0B4CA7C901D51F0C794134

Windows6.0-KB3101722-x86.msu

3594341F8247F2869EF600541B7B73B0B844C30A

90131D544BB25FF236B524AF2593C73C53BA5C676A0B4CA7C901D51F0C794134

Windows6.0-KB3101722-ia64.msu

05AB8420A74BE80498B961F37DEBBA7DC9EC7310

5E665C36D5E1733642EAE4DD05529B40F9E26AE74C43522156F3E1A48C94726B

Windows6.0-KB3101722-x64.msu

7C00D829D3647C4C33B54F2A2C2C5352C02B8848

A2502A2682573E26AC0F58751543170D067E0E80D8621E865D82B519FCA195C8

Windows6.0-KB3101722-x64.msu

7C00D829D3647C4C33B54F2A2C2C5352C02B8848

A2502A2682573E26AC0F58751543170D067E0E80D8621E865D82B519FCA195C8

Windows6.1-KB3101722-ia64.msu

E988DA6C20E57431E7ED82C493C97EB9CBD0A014

0E2F1F8E33DE1E7EC05ADC912961EA15347234A50873EC5D381BA4A0814B16B1

Windows6.1-KB3101722-x64.msu

068F82BEA5CF9AB7B2DB99DECC412BD28EF4AED3

8EB13A420438285B40F469E060D3AE675B15497A9EA67C4888226DBA07B749D6

Windows6.1-KB3101722-x64.msu

068F82BEA5CF9AB7B2DB99DECC412BD28EF4AED3

8EB13A420438285B40F469E060D3AE675B15497A9EA67C4888226DBA07B749D6

Windows6.0-KB3101722-x86.msu

3594341F8247F2869EF600541B7B73B0B844C30A

90131D544BB25FF236B524AF2593C73C53BA5C676A0B4CA7C901D51F0C794134

Windows6.0-KB3101722-x64.msu

7C00D829D3647C4C33B54F2A2C2C5352C02B8848

A2502A2682573E26AC0F58751543170D067E0E80D8621E865D82B519FCA195C8


The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.

Windows Vista and Windows Server 2008 file information

  • The files that apply to a specific product, milestone (SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:

    Version

    Product

    Milestone

    Service branch

    6.0.6002.19xxx

    Windows Vista SP2 or Windows Server 2008 SP2

    SP2

    GDR

    6.0.6002.23xxx

    Windows Vista SP2 or Windows Server 2008 SP2

    SP2

    LDR

  • GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.

Note The MANIFEST files (.manifest) and MUM files (.mum) that are installed are not listed.

For all supported x86-based versions of Windows Vista and Windows Server 2008

File name

File version

File size

Date

Time

Platform

Ndis.sys

6.0.6002.19512

526,272

10-Oct-2015

16:02

x86

Ndismigplugin.dll

6.0.6001.18000

129,024

19-Jan-2008

07:35

x86

Ndistrace.mof

Not Applicable

4,548

18-Sep-2006

21:36

Not Applicable

Ndis.sys

6.0.6002.23822

526,272

10-Oct-2015

15:38

x86

Ndismigplugin.dll

6.0.6002.23822

129,024

10-Oct-2015

15:33

x86

Ndistrace.mof

Not Applicable

4,548

07-May-2014

23:52

Not Applicable

For all supported x64-based versions of Windows Vista and Windows Server 2008

File name

File version

File size

Date

Time

Platform

Ndis.sys

6.0.6002.19512

736,192

10-Oct-2015

15:48

x64

Ndismigplugin.dll

6.0.6001.18000

137,216

19-Jan-2008

08:03

x64

Ndistrace.mof

Not Applicable

4,548

18-Sep-2006

21:34

Not Applicable

Ndis.sys

6.0.6002.23822

736,704

10-Oct-2015

15:30

x64

Ndismigplugin.dll

6.0.6002.23822

137,216

10-Oct-2015

15:25

x64

Ndistrace.mof

Not Applicable

4,548

07-May-2014

23:52

Not Applicable

For all supported IA-64-based versions of Windows Server 2008

File name

File version

File size

Date

Time

Platform

Ndis.sys

6.0.6002.19512

1,643,968

10-Oct-2015

15:29

IA-64

Ndismigplugin.dll

6.0.6001.18000

314,880

19-Jan-2008

08:29

IA-64

Ndistrace.mof

Not Applicable

4,548

03-Jan-2008

18:51

Not Applicable

Ndis.sys

6.0.6002.23822

1,644,992

10-Oct-2015

15:08

IA-64

Ndismigplugin.dll

6.0.6002.23822

314,368

10-Oct-2015

15:02

IA-64

Ndistrace.mof

Not Applicable

4,548

07-May-2014

23:53

Not Applicable

Windows 7 and Windows Server 2008 R2 file information

  • The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:

    Version

    Product

    Milestone

    Service branch

    6.1.7601.18 xxx

    Windows 7 or Windows Server 2008 R2

    SP1

    GDR

    6.1.7601.23 xxx

    Windows 7 or Windows Server 2008 R2

    SP1

    LDR

  • GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.

Note The MANIFEST files (.manifest) and MUM files (.mum) that are installed are not listed.

For all supported x86-based versions of Windows 7

File name

File version

File size

Date

Time

Platform

Ndis.sys

6.1.7601.19030

712,640

13-Oct-2015

04:50

x86

Ndismigplugin.dll

6.1.7601.19030

156,160

13-Oct-2015

04:44

x86

Ndistrace.mof

Not Applicable

4,548

03-Jun-2015

20:15

Not Applicable

Ndis.sys

6.1.7601.23235

713,152

12-Oct-2015

22:32

x86

Ndismigplugin.dll

6.1.7601.23235

156,160

12-Oct-2015

22:27

x86

Ndistrace.mof

Not Applicable

4,548

03-Jun-2015

20:14

Not Applicable


For all supported x64-based versions of Windows 7 and Windows Server 2008 R2

File name

File version

File size

Date

Time

Platform

Ndis.sys

6.1.7601.19030

950,720

13-Oct-2015

04:57

x64

Ndismigplugin.dll

6.1.7601.19030

166,912

13-Oct-2015

04:51

x64

Ndistrace.mof

Not Applicable

4,548

03-Jun-2015

20:15

Not Applicable

Ndis.sys

6.1.7601.23235

949,184

12-Oct-2015

23:04

x64

Ndismigplugin.dll

6.1.7601.23235

166,912

12-Oct-2015

22:58

x64

Ndistrace.mof

Not Applicable

4,548

03-Jun-2015

20:15

Not Applicable

For all supported IA-64-based versions of Windows Server 2008 R2

File name

File version

File size

Date

Time

Platform

Ndis.sys

6.1.7601.19030

2,000,320

13-Oct-2015

04:02

IA-64

Ndismigplugin.dll

6.1.7601.19030

357,376

13-Oct-2015

03:56

IA-64

Ndistrace.mof

Not Applicable

4,548

03-Jun-2015

20:12

Not Applicable

Ndis.sys

6.1.7601.23235

1,999,808

12-Oct-2015

21:59

IA-64

Ndismigplugin.dll

6.1.7601.23235

357,376

12-Oct-2015

21:54

IA-64

Ndistrace.mof

Not Applicable

4,548

03-Jun-2015

20:13

Not Applicable


Help for installing updates: Support for Microsoft Update

Security solutions for IT professionals: TechNet Security Troubleshooting and Support

Help for protecting your Windows-based computer from viruses and malware: Virus Solution and Security Center

Local support according to your country: International Support

Need more help?

Expand your skills
Explore Training
Get new features first
Join Microsoft Insiders

Was this information helpful?

Thank you for your feedback!

Thank you for your feedback! It sounds like it might be helpful to connect you to one of our Office support agents.

×