KB-MS15-124-CVE-2015-6161-User32-Exception-Handler-Hardening

Overview

This update enables the Microsoft Internet Explorer User32 Exception Handler Hardening policy by placing a registry value that allows the browser process to consume the hardening setting.

The mitigation sets the following feature-control value:

• Registry key: HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_USER32_EXCEPTION_HANDLER_HARDENING

• Value name: iexplore.exe

• Data type: DWORD

• Data value: 1

This is the registry-based setting described by Microsoft for the hardening control associated with MS15-124.

Solution

1. Access the Device

• Log in to the Windows device where the mitigation needs to be applied.

• Ensure that you have the required Administrator privileges to modify system-level registry settings.

2. Configure the Registry Setting

• Open the Windows Registry Editor.

• Navigate to the following registry path:

  HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_USER32_EXCEPTION_HANDLER_HARDENING

• If the required registry key does not exist, create the following key:

  FEATURE_ALLOW_USER32_EXCEPTION_HANDLER_HARDENING

3. Create the Feature-Control Value

Under the FEATURE_ALLOW_USER32_EXCEPTION_HANDLER_HARDENING registry key, create or configure the following value:

• Value name: iexplore.exe

• Data type: DWORD

• Data value: 1

The final registry configuration should be:

Registry key: HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_USER32_EXCEPTION_HANDLER_HARDENING Value name: iexplore.exe Data type: DWORD Data value: 1

4. Apply the Mitigation Using the Executable

The executable is intended to create the IE feature-control policy that permits User32 Exception Handler Hardening.

In practical terms, the executable writes the required system-level registry value so Internet Explorer can use the hardening feature-control path.

When the executable is used to apply the mitigation, it creates or configures the required registry setting:

• Registry key: HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_USER32_EXCEPTION_HANDLER_HARDENING

• Value name: iexplore.exe

• Data type: DWORD

• Data value: 1

5. Verify the Registry Configuration

After applying the mitigation, verify that the following registry configuration exists:

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_USER32_EXCEPTION_HANDLER_HARDENING iexplore.exe    REG_DWORD    0x1

The presence of the iexplore.exe DWORD value with data 1 confirms that the registry-based hardening setting has been configured.

6. Verify the Mitigation

• Confirm that the registry key and value are present on the target device.

• Verify that the iexplore.exe value is configured as a DWORD.

• Confirm that the data value is set to 1.

• This allows the Internet Explorer browser process to consume the User32 Exception Handler Hardening feature-control setting.
  

What the Executable Does

The executable is intended to create the IE feature-control policy that permits User32 Exception Handler Hardening. In practical terms, the executable writes the required system-level registry value so Internet Explorer can use the hardening feature-control path.

References

Microsoft Security Bulletin MS15-124:

https://learn.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-124