Microsoft released a set of updates, April 2014
The company has released a series of updates for its products, which fix 11 unique vulnerabilities in Microsoft Windows, Internet Explorer and Office products. All patches close vulnerabilities like Remote Code Execution , two of them have the status Critical and two more Important. Update MS14-017 closes a known vulnerability CVE-2014-1761 in all supported versions of MS Word 2003-2013. Earlier, we wrote that attackers used an exploit for this vulnerability to carry out attacks on MS Word 2010 users who use the insecure mscomctl.ocx library compiled without ASLR support. Word 2013 users are protected from security vulnerability similar to Security Feature Bypass because Microsoft supports ASLR for all modules loaded into memory (enforce ASLR randomization natively) for this product.
This patch tuesday also contains an MS14-018 update for all versions of Internet Explorer 6-11 on all operating systems from Windows XP to Windows 8 / 8.1. Attackers can use a specially prepared web page for remote code execution in a browser (drive-by download). The update fixes six memory-corruption vulnerabilities in IE. A reboot is required to apply fixes. This is the latest patch tuesday, in which the company releases updates for Windows XP and MS Office 2003.
')
Update MS14-017 closes three vulnerabilities in all versions of Office: CVE-2014-1757, CVE-2014-1758, CVE-2014-1761. The first vulnerability is present in the Office File Format Converter component, attackers can prepare a special document through which you can execute code on a remote system. Using the second RCE stack-overflow vulnerability in Word 2003, attackers can also execute remote code on the system. Vulnerability is exploited in-the-wild .
The MS14-019 update fixes one Remote Code Execution vulnerability CVE-2014-0315 in the Windows File Handling component on all Windows XP - 8 / 8.1 operating systems. Vulnerability is present in the processing of batch .bat and .cmd files . Attackers can trigger remote code execution when opening a specific file of this type over the network by substituting cmd.exe with its own copy of the file (CMD hijack) in the current directory (CWD). When executing CreateProcess of such files, it can call the cmd interpreter from the CWD directory, i.e., the replaced file. Exploit code likely .
Update MS14-020 closes one arbitrary-pointer-dereference vulnerability CVE-2014-1759 in MS Publisher 2003 and 2007. Attackers can trigger remote code execution using a specially prepared file for Publisher. Exploit code likely .
1 - Exploit code likely
The probability of exploiting the vulnerability is very high, attackers can use an exploit, for example, for remote code execution.
2 - Exploit code would be difficult to build
The exploitation probability is average, since attackers are unlikely to be able to achieve a situation of sustainable exploitation, as well as due to the technical peculiarities of vulnerability and the complexity of developing an exploit.
3 - Exploit code unlikely
The exploitation probability is minimal and attackers are unlikely to be able to develop successfully working code and take advantage of this vulnerability to conduct an attack.
We recommend our users to install updates as soon as possible and, if you have not already done so, enable automatic delivery of updates using Windows Update (by default this option is enabled).
be secure.
This patch tuesday also contains an MS14-018 update for all versions of Internet Explorer 6-11 on all operating systems from Windows XP to Windows 8 / 8.1. Attackers can use a specially prepared web page for remote code execution in a browser (drive-by download). The update fixes six memory-corruption vulnerabilities in IE. A reboot is required to apply fixes. This is the latest patch tuesday, in which the company releases updates for Windows XP and MS Office 2003.
')
Update MS14-017 closes three vulnerabilities in all versions of Office: CVE-2014-1757, CVE-2014-1758, CVE-2014-1761. The first vulnerability is present in the Office File Format Converter component, attackers can prepare a special document through which you can execute code on a remote system. Using the second RCE stack-overflow vulnerability in Word 2003, attackers can also execute remote code on the system. Vulnerability is exploited in-the-wild .
The MS14-019 update fixes one Remote Code Execution vulnerability CVE-2014-0315 in the Windows File Handling component on all Windows XP - 8 / 8.1 operating systems. Vulnerability is present in the processing of batch .bat and .cmd files . Attackers can trigger remote code execution when opening a specific file of this type over the network by substituting cmd.exe with its own copy of the file (CMD hijack) in the current directory (CWD). When executing CreateProcess of such files, it can call the cmd interpreter from the CWD directory, i.e., the replaced file. Exploit code likely .
Update MS14-020 closes one arbitrary-pointer-dereference vulnerability CVE-2014-1759 in MS Publisher 2003 and 2007. Attackers can trigger remote code execution using a specially prepared file for Publisher. Exploit code likely .
1 - Exploit code likely
The probability of exploiting the vulnerability is very high, attackers can use an exploit, for example, for remote code execution.
2 - Exploit code would be difficult to build
The exploitation probability is average, since attackers are unlikely to be able to achieve a situation of sustainable exploitation, as well as due to the technical peculiarities of vulnerability and the complexity of developing an exploit.
3 - Exploit code unlikely
The exploitation probability is minimal and attackers are unlikely to be able to develop successfully working code and take advantage of this vulnerability to conduct an attack.
We recommend our users to install updates as soon as possible and, if you have not already done so, enable automatic delivery of updates using Windows Update (by default this option is enabled).
be secure.
Source: https://habr.com/ru/post/218699/
All Articles