Microsoft security alert.
February 11, 2014
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 31 vulnerabilities that were fixed in 7 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 7 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft XML Core Services Remote Information Disclosure (MS14-005)
- Severity
- Serious 3
- Qualys ID
- 90939
- Vendor Reference
- MS14-005
- CVE Reference
- CVE-2014-0266
- CVSS Scores
- Base 7.1 / Temporal 6.2
- Description
-
This security update resolves a publicly disclosed vulnerability in Microsoft XML Core Services included in Microsoft Windows.
The security update addresses the vulnerability by correcting the way that MSXML verifies same-origin policy of URLs.
Affected Software:
This security update is rated Important for affected Windows clients and rated Low for affected Windows servers. - Consequence
- If this vulnerability is successfully exploited, attackers can read files on the user's local file system, or read content of web domains where the user is currently authenticated.
- Solution
-
Refer to Microsoft's advisory MS14-005 for more details about patches.
Workaround:
Following Workarounds are available:
Prevent MSXML 3.0 binary behaviors from being used in Internet Explorer.
Set Internet and Local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones
Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.
Add sites that you trust to the Internet Explorer Trusted sites zone.
Refer to the following link for further details: MS14-005
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-005 Windows 7 for 32-bit Systems Service Pack 1
MS14-005 Windows 7 for x64-based Systems Service Pack 1
MS14-005 Windows 8 for 32-bit Systems
MS14-005 Windows 8 for x64-based Systems
MS14-005 Windows 8.1 for 32-bit Systems
MS14-005 Windows 8.1 for x64-based Systems
MS14-005 Windows Server 2003 Service Pack 2
MS14-005 Windows Server 2003 with SP2 for Itanium-based Systems
MS14-005 Windows Server 2003 x64 Edition Service Pack 2
MS14-005 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS14-005 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS14-005 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS14-005 Windows Server 2008 for 32-bit Systems Service Pack 2
MS14-005 Windows Server 2008 for 32-bit Systems Service Pack 2
MS14-005 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS14-005 Windows Server 2008 for x64-based Systems Service Pack 2
MS14-005 Windows Server 2008 for x64-based Systems Service Pack 2
MS14-005 Windows Server 2012
MS14-005 Windows Server 2012
MS14-005 Windows Server 2012 R2
MS14-005 Windows Server 2012 R2
MS14-005 Windows Vista Service Pack 2
MS14-005 Windows Vista x64 Edition Service Pack 2
MS14-005 Windows XP Professional x64 Edition Service Pack 2
MS14-005 Windows XP Service Pack 3
-
Microsoft Windows IPv6 Denial of Service Vulnerability (MS14-006)
- Severity
- Serious 3
- Qualys ID
- 90940
- Vendor Reference
- MS14-006
- CVE Reference
- CVE-2014-0254
- CVSS Scores
- Base 7.8 / Temporal 6.1
- Description
-
This security update resolves a publicly disclosed vulnerability in Windows implementation of IPv6 TCP/IP.
The vulnerability occurs when an attacker sends large amounts of crafted IPv6 router advertisement packets over a targeted subnet.
Affected Software:
This security update is rated Important for affected Windows 8, Windows Server 2012 and Windows RT. - Consequence
-
Successful exploitation could allow an unauthenticated, remote attacker to cause the targeted system to stop responding to legitimate user queries, leading to a denial of service.
- Solution
-
Refer to Microsoft Security Bulletin MS14-006 for further details.
Workaround:
Any of the configuration changes below would not correct the underlying vulnerability but would help block known attack vectors.
- Disable the Router Discovery Protocol
- Disable Internet Protocol version 6 (IPv6)
- Disable the "Core Networking - Router Advertisement (ICMPv6-In)" inbound firewall rule
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-006 Windows 8 for 32-bit Systems
MS14-006 Windows 8 for x64-based Systems
MS14-006 Windows Server 2012
MS14-006 Windows Server 2012
-
Microsoft Direct2D Graphics Component Memory Corruption Vulnerability (MS14-007)
- Severity
- Critical 4
- Qualys ID
- 90938
- Vendor Reference
- MS14-007
- CVE Reference
- CVE-2014-0263
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
Direct2D is a hardware-accelerated, immediate-mode 2-D graphics API that provides high performance and high-quality rendering for 2-D geometry, bitmaps, and text. The Direct2D API is designed to interoperate with existing code that uses GDI, GDI+, or Direct3D.
A remote code execution vulnerability exists in the way affected Windows components handle specially crafted 2D geometric figures. The vulnerability occurs when Direct2D fails to properly handle a specially crafted 2D geometric figure.
This security update is rated Critical for all supported editions of Windows 7, Windows 2008 R2, Windows 8, Windows Server 2012, Windows RT, Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1.
- Consequence
- Successful exploitation could allow remote code execution if a user views files containing such specially crafted figures using Internet Explorer. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.
- Solution
-
Customers are advised to view MS14-007 for further information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-007 Windows 7 for 32-bit Systems Service Pack 1
MS14-007 Windows 7 for x64-based Systems Service Pack 1
MS14-007 Windows 8 for 32-bit Systems
MS14-007 Windows 8 for x64-based Systems
MS14-007 Windows 8.1 for 32-bit Systems
MS14-007 Windows 8.1 for x64-based Systems
MS14-007 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS14-007 Windows Server 2012
MS14-007 Windows Server 2012 R2
-
Microsoft Forefront Protection for Exchange Remote Code Execution Vulnerability (MS14-008)
- Severity
- Critical 4
- Qualys ID
- 90941
- Vendor Reference
- MS14-008
- CVE Reference
- CVE-2014-0294
- CVSS Scores
- Base 10 / Temporal 7.4
- Description
-
A remote code execution vulnerability exists in Forefront Protection for Exchange. An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the configured service account.
The security update addresses the vulnerability by removing the vulnerable code from Microsoft Forefront Protection for Exchange Server.
This security update is rated Critical for all supported builds of Microsoft Forefront Protection for Exchange 2010.
- Consequence
- The vulnerability could allow remote code execution if a specially crafted email message is scanned.
- Solution
-
Refer to Microsoft Security Bulletin MS14-008 for further details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-008 Microsoft Forefront Protection 2010 for Exchange Server
-
Microsoft .NET Framework Elevation of Privileges and Denial of Service Vulnerabilities (MS14-009)
- Severity
- Critical 4
- Qualys ID
- 90943
- Vendor Reference
- MS14-009
- CVE Reference
- CVE-2014-0253, CVE-2014-0257, CVE-2014-0295
- CVSS Scores
- Base 9.3 / Temporal 8.1
- Description
-
The Microsoft .NET Framework is a software framework for computers running Microsoft Windows operating systems.
Microsoft .NET Framework is exposed to the following vulnerabilities:
A denial of service vulnerability exists in Microsoft ASP.NET that could allow an attacker to cause an ASP.NET server to become unresponsive (CVE-2014-0253).
An elevation of privilege vulnerability exists in the Microsoft.NET Framework that could allow an attacker to elevate privileges on the targeted system (CVE-2014-0257).
A security feature bypass exists in a .NET Framework component that does not properly implement Address Space Layout Randomization (ASLR). The vulnerability could allow an attacker to bypass the ASLR security feature, after which the attacker could load additional malicious code in the process in an attempt to exploit another vulnerability (CVE-2014-0295).This security update is rated Important for Microsoft .NET Framework 1.0 Service Pack 3, Microsoft .NET Framework 1.1 Service Pack 1, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4, Microsoft .NET Framework 4.5, and Microsoft .NET Framework 4.5.1 on affected editions of Microsoft Windows.
- Consequence
- Successfully exploiting this vulnerability might allow a remote attacker to gain escalated privileges or cause denial of service.
- Solution
-
Refer to MS14-009 for further information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-009 Windows 7 for 32-bit Systems Service Pack 1(Microsoft .NET Framework 3.5.1)
MS14-009 Windows 7 for 32-bit Systems Service Pack 1(Microsoft .NET Framework 3.5.1)
MS14-009 Windows 7 for 32-bit Systems Service Pack 1(Microsoft .NET Framework 3.5.1)
MS14-009 Windows 7 for 32-bit Systems Service Pack 1(Microsoft .NET Framework 4)
MS14-009 Windows 7 for 32-bit Systems Service Pack 1(Microsoft .NET Framework 4)
MS14-009 Windows 7 for 32-bit Systems Service Pack 1(Microsoft .NET Framework 4.5)
MS14-009 Windows 7 for 32-bit Systems Service Pack 1(Microsoft .NET Framework 4.5)
MS14-009 Windows 7 for 32-bit Systems Service Pack 1(Microsoft .NET Framework 4.5.1)
MS14-009 Windows 7 for 32-bit Systems Service Pack 1(Microsoft .NET Framework 4.5.1)
MS14-009 Windows 7 for x64-based Systems Service Pack 1(Microsoft .NET Framework 3.5.1)
MS14-009 Windows 7 for x64-based Systems Service Pack 1(Microsoft .NET Framework 3.5.1)
MS14-009 Windows 7 for x64-based Systems Service Pack 1(Microsoft .NET Framework 3.5.1)
MS14-009 Windows 7 for x64-based Systems Service Pack 1(Microsoft .NET Framework 4)
MS14-009 Windows 7 for x64-based Systems Service Pack 1(Microsoft .NET Framework 4)
MS14-009 Windows 7 for x64-based Systems Service Pack 1(Microsoft .NET Framework 4.5)
MS14-009 Windows 7 for x64-based Systems Service Pack 1(Microsoft .NET Framework 4.5)
MS14-009 Windows 7 for x64-based Systems Service Pack 1(Microsoft .NET Framework 4.5.1)
MS14-009 Windows 7 for x64-based Systems Service Pack 1(Microsoft .NET Framework 4.5.1)
MS14-009 Windows 8 for 32-bit Systems(Microsoft .NET Framework 3.5)
MS14-009 Windows 8 for 32-bit Systems(Microsoft .NET Framework 3.5)
MS14-009 Windows 8 for 32-bit Systems(Microsoft .NET Framework 4.5)
MS14-009 Windows 8 for 32-bit Systems(Microsoft .NET Framework 4.5)
MS14-009 Windows 8 for 32-bit Systems(Microsoft .NET Framework 4.5.1)
MS14-009 Windows 8 for 32-bit Systems(Microsoft .NET Framework 4.5.1)
MS14-009 Windows 8 for x64-based Systems(Microsoft .NET Framework 3.5)
MS14-009 Windows 8 for x64-based Systems(Microsoft .NET Framework 3.5)
MS14-009 Windows 8 for x64-based Systems(Microsoft .NET Framework 4.5)
MS14-009 Windows 8 for x64-based Systems(Microsoft .NET Framework 4.5)
MS14-009 Windows 8 for x64-based Systems(Microsoft .NET Framework 4.5.1)
MS14-009 Windows 8 for x64-based Systems(Microsoft .NET Framework 4.5.1)
MS14-009 Windows 8.1 for 32-bit Systems(Microsoft .NET Framework 3.5)
MS14-009 Windows 8.1 for 32-bit Systems(Microsoft .NET Framework 3.5)
MS14-009 Windows 8.1 for 32-bit Systems(Microsoft .NET Framework 4.5.1)
MS14-009 Windows 8.1 for 32-bit Systems(Microsoft .NET Framework 4.5.1)
MS14-009 Windows 8.1 for x64-based Systems(Microsoft .NET Framework 3.5)
MS14-009 Windows 8.1 for x64-based Systems(Microsoft .NET Framework 3.5)
MS14-009 Windows 8.1 for x64-based Systems(Microsoft .NET Framework 4.5.1)
MS14-009 Windows 8.1 for x64-based Systems(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Server 2003 Service Pack 2(Microsoft .NET Framework 1.1 Service Pack 1)
MS14-009 Windows Server 2003 Service Pack 2(Microsoft .NET Framework 1.1 Service Pack 1)
MS14-009 Windows Server 2003 Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Server 2003 Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Server 2003 Service Pack 2(Microsoft .NET Framework 4)
MS14-009 Windows Server 2003 Service Pack 2(Microsoft .NET Framework 4)
MS14-009 Windows Server 2003 with SP2 for Itanium-based Systems(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Server 2003 with SP2 for Itanium-based Systems(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Server 2003 with SP2 for Itanium-based Systems(Microsoft .NET Framework 4)
MS14-009 Windows Server 2003 with SP2 for Itanium-based Systems(Microsoft .NET Framework 4)
MS14-009 Windows Server 2003 x64 Edition Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Server 2003 x64 Edition Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Server 2003 x64 Edition Service Pack 2(Microsoft .NET Framework 4)
MS14-009 Windows Server 2003 x64 Edition Service Pack 2(Microsoft .NET Framework 4)
MS14-009 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1(Microsoft .NET Framework 3.5.1)
MS14-009 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1(Microsoft .NET Framework 3.5.1)
MS14-009 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1(Microsoft .NET Framework 3.5.1)
MS14-009 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1(Microsoft .NET Framework 4)
MS14-009 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1(Microsoft .NET Framework 4)
MS14-009 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Microsoft .NET Framework 3.5.1)
MS14-009 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Microsoft .NET Framework 3.5.1)
MS14-009 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Microsoft .NET Framework 3.5.1)
MS14-009 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Microsoft .NET Framework 4)
MS14-009 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Microsoft .NET Framework 4)
MS14-009 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Microsoft .NET Framework 4.5)
MS14-009 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Microsoft .NET Framework 4.5)
MS14-009 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)(Microsoft .NET Framework 3.5.1)
MS14-009 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)(Microsoft .NET Framework 3.5.1)
MS14-009 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)(Microsoft .NET Framework 3.5.1)
MS14-009 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)(Microsoft .NET Framework 4)
MS14-009 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)(Microsoft .NET Framework 4.5)
MS14-009 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)(Microsoft .NET Framework 4.5)
MS14-009 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Server 2008 for 32-bit Systems Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Server 2008 for 32-bit Systems Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Server 2008 for 32-bit Systems Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Server 2008 for 32-bit Systems Service Pack 2(Microsoft .NET Framework 4)
MS14-009 Windows Server 2008 for 32-bit Systems Service Pack 2(Microsoft .NET Framework 4)
MS14-009 Windows Server 2008 for 32-bit Systems Service Pack 2(Microsoft .NET Framework 4.5)
MS14-009 Windows Server 2008 for 32-bit Systems Service Pack 2(Microsoft .NET Framework 4.5)
MS14-009 Windows Server 2008 for 32-bit Systems Service Pack 2(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Server 2008 for 32-bit Systems Service Pack 2(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Server 2008 for Itanium-based Systems Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Server 2008 for Itanium-based Systems Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Server 2008 for Itanium-based Systems Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Server 2008 for Itanium-based Systems Service Pack 2(Microsoft .NET Framework 4)
MS14-009 Windows Server 2008 for Itanium-based Systems Service Pack 2(Microsoft .NET Framework 4)
MS14-009 Windows Server 2008 for x64-based Systems Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Server 2008 for x64-based Systems Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Server 2008 for x64-based Systems Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Server 2008 for x64-based Systems Service Pack 2(Microsoft .NET Framework 4)
MS14-009 Windows Server 2008 for x64-based Systems Service Pack 2(Microsoft .NET Framework 4)
MS14-009 Windows Server 2008 for x64-based Systems Service Pack 2(Microsoft .NET Framework 4.5)
MS14-009 Windows Server 2008 for x64-based Systems Service Pack 2(Microsoft .NET Framework 4.5)
MS14-009 Windows Server 2008 for x64-based Systems Service Pack 2(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Server 2008 for x64-based Systems Service Pack 2(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Server 2012(Microsoft .NET Framework 3.5)
MS14-009 Windows Server 2012(Microsoft .NET Framework 3.5)
MS14-009 Windows Server 2012(Microsoft .NET Framework 4.5)
MS14-009 Windows Server 2012(Microsoft .NET Framework 4.5)
MS14-009 Windows Server 2012(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Server 2012(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Server 2012 (Server Core installation)(Microsoft .NET Framework 3.5)
MS14-009 Windows Server 2012 (Server Core installation)(Microsoft .NET Framework 3.5)
MS14-009 Windows Server 2012 (Server Core installation)(Microsoft .NET Framework 4.5)
MS14-009 Windows Server 2012 (Server Core installation)(Microsoft .NET Framework 4.5)
MS14-009 Windows Server 2012 (Server Core installation)(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Server 2012 (Server Core installation)(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Server 2012 R2(Microsoft .NET Framework 3.5)
MS14-009 Windows Server 2012 R2(Microsoft .NET Framework 3.5)
MS14-009 Windows Server 2012 R2(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Server 2012 R2(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Server 2012 R2 (Server Core installation)(Microsoft .NET Framework 3.5)
MS14-009 Windows Server 2012 R2 (Server Core installation)(Microsoft .NET Framework 3.5)
MS14-009 Windows Server 2012 R2 (Server Core installation)(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Server 2012 R2 (Server Core installation)(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Vista Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Vista Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Vista Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Vista Service Pack 2(Microsoft .NET Framework 4)
MS14-009 Windows Vista Service Pack 2(Microsoft .NET Framework 4)
MS14-009 Windows Vista Service Pack 2(Microsoft .NET Framework 4.5)
MS14-009 Windows Vista Service Pack 2(Microsoft .NET Framework 4.5)
MS14-009 Windows Vista Service Pack 2(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Vista Service Pack 2(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Vista x64 Edition Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Vista x64 Edition Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Vista x64 Edition Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows Vista x64 Edition Service Pack 2(Microsoft .NET Framework 4)
MS14-009 Windows Vista x64 Edition Service Pack 2(Microsoft .NET Framework 4)
MS14-009 Windows Vista x64 Edition Service Pack 2(Microsoft .NET Framework 4.5)
MS14-009 Windows Vista x64 Edition Service Pack 2(Microsoft .NET Framework 4.5)
MS14-009 Windows Vista x64 Edition Service Pack 2(Microsoft .NET Framework 4.5.1)
MS14-009 Windows Vista x64 Edition Service Pack 2(Microsoft .NET Framework 4.5.1)
MS14-009 Windows XP Professional x64 Edition Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows XP Professional x64 Edition Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows XP Professional x64 Edition Service Pack 2(Microsoft .NET Framework 4)
MS14-009 Windows XP Professional x64 Edition Service Pack 2(Microsoft .NET Framework 4)
MS14-009 Windows XP Service Pack 3(Microsoft .NET Framework 1.0 Service Pack 3)
MS14-009 Windows XP Service Pack 3(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows XP Service Pack 3(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-009 Windows XP Service Pack 3(Microsoft .NET Framework 4)
MS14-009 Windows XP Service Pack 3(Microsoft .NET Framework 4)
-
Microsoft Internet Explorer Multiple Remote Code Execution Vulnerabilities (MS14-010)
- Severity
- Urgent 5
- Qualys ID
- 100178
- Vendor Reference
- MS14-010
- CVE Reference
- CVE-2014-0267, CVE-2014-0268, CVE-2014-0269, CVE-2014-0270, CVE-2014-0271, CVE-2014-0272, CVE-2014-0273, CVE-2014-0274, CVE-2014-0275, CVE-2014-0276, CVE-2014-0277, CVE-2014-0278, CVE-2014-0279, CVE-2014-0280, CVE-2014-0281, CVE-2014-0283, CVE-2014-0284, CVE-2014-0285, CVE-2014-0286, CVE-2014-0287, CVE-2014-0288, CVE-2014-0289, CVE-2014-0290, CVE-2014-0293
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft Internet Explorer is a graphical web browser developed by Microsoft and included as part of the Microsoft Windows operating systems.
Microsoft Internet Explorer is affected by multiple memory corruption vulnerabilities because it improperly handles objects in memory.
Microsoft Internet Explorer is affected by an elevation of privilege vulnerability due to the way it handles validation of local file installation and secure creation of registry keys.
Microsoft Internet Explorer is affected by a remote code execution vulnerability in the way that the VBScript engine handles objects in memory.
Microsoft Internet Explorer is affected by an information disclosure vulnerability that could allow an attacker to gain access to information in another domain or Internet Explorer zone.An attacker could host a specially crafted website designed to exploit these vulnerabilities through Internet Explorer and then convince a user to view the website.
This security update is rated Critical for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11 on affected Windows clients, Important for Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11 on affected Windows servers, and Moderate for Internet Explorer 6 and Internet Explorer 7 on supported editions of Windows Server 2003.
- Consequence
-
An attacker who successfully exploited these vulnerabilities could execute arbitrary code on affected systems with elevated privileges.
- Solution
-
Please refer to MS14-010 for details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-010 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 10)
MS14-010 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 11)
MS14-010 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 8)
MS14-010 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 9)
MS14-010 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 10)
MS14-010 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 11)
MS14-010 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 8)
MS14-010 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 9)
MS14-010 Windows 8 for 32-bit Systems(Internet Explorer 10)
MS14-010 Windows 8 for x64-based Systems(Internet Explorer 10)
MS14-010 Windows 8.1 for 32-bit Systems(Internet Explorer 11)
MS14-010 Windows 8.1 for x64-based Systems(Internet Explorer 11)
MS14-010 Windows Server 2003 Service Pack 2(Internet Explorer 6)
MS14-010 Windows Server 2003 Service Pack 2(Internet Explorer 7)
MS14-010 Windows Server 2003 Service Pack 2(Internet Explorer 8)
MS14-010 Windows Server 2003 with SP2 for Itanium-based Systems(Internet Explorer 6)
MS14-010 Windows Server 2003 with SP2 for Itanium-based Systems(Internet Explorer 7)
MS14-010 Windows Server 2003 x64 Edition Service Pack 2(Internet Explorer 6)
MS14-010 Windows Server 2003 x64 Edition Service Pack 2(Internet Explorer 7)
MS14-010 Windows Server 2003 x64 Edition Service Pack 2(Internet Explorer 8)
MS14-010 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1(Internet Explorer 8)
MS14-010 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 10)
MS14-010 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 11)
MS14-010 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 8)
MS14-010 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 9)
MS14-010 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 7)
MS14-010 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 8)
MS14-010 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 9)
MS14-010 Windows Server 2008 for Itanium-based Systems Service Pack 2(Internet Explorer 7)
MS14-010 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 7)
MS14-010 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 8)
MS14-010 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 9)
MS14-010 Windows Server 2012(Internet Explorer 10)
MS14-010 Windows Server 2012 R2(Internet Explorer 11)
MS14-010 Windows Vista Service Pack 2(Internet Explorer 7)
MS14-010 Windows Vista Service Pack 2(Internet Explorer 8)
MS14-010 Windows Vista Service Pack 2(Internet Explorer 9)
MS14-010 Windows Vista x64 Edition Service Pack 2(Internet Explorer 7)
MS14-010 Windows Vista x64 Edition Service Pack 2(Internet Explorer 8)
MS14-010 Windows Vista x64 Edition Service Pack 2(Internet Explorer 9)
MS14-010 Windows XP Professional x64 Edition Service Pack 2(Internet Explorer 6)
MS14-010 Windows XP Professional x64 Edition Service Pack 2(Internet Explorer 7)
MS14-010 Windows XP Professional x64 Edition Service Pack 2(Internet Explorer 8)
MS14-010 Windows XP Service Pack 3(Internet Explorer 6)
MS14-010 Windows XP Service Pack 3(Internet Explorer 7)
MS14-010 Windows XP Service Pack 3(Internet Explorer 8)
-
Microsoft VBScript Remote Code Execution Vulnerability (MS14-011)
- Severity
- Urgent 5
- Qualys ID
- 90942
- Vendor Reference
- MS14-011
- CVE Reference
- CVE-2014-0271
- CVSS Scores
- Base 9.3 / Temporal 7.3
- Description
-
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. Exploitation of this vulnerability will allow an attacker to execute arbitrary code.
This security update is rated Critical for affected versions of the VBScript scripting engine on affected Windows clients and Moderate for affected versions of the VBScript scripting engine on affected Windows servers.
Affected Versions:
VBScript 5.6
VBScript 5.7
VBScript 5.8 (Affecting Internet Explorer 8,9,10,11)
VBScript 5.7 (Affecting Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) and Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation))
VBScript 5.8 (Affecting Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) ,Windows Server 2012 (Server Core installation) and Windows Server 2012 R2 (Server Core installation) ) - Consequence
- Successful exploitation of this vulnerability will allow a remote attacker to execute arbitrary code in the context of logged in user. Failed exploits may result in denial of service
- Solution
-
Please refer to MS14-011 for details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-011 Windows 7 for 32-bit Systems Service Pack 1(VBScript 5.8)
MS14-011 Windows 7 for 32-bit Systems Service Pack 1(VBScript 5.8)
MS14-011 Windows 7 for 32-bit Systems Service Pack 1(VBScript 5.8)
MS14-011 Windows 7 for x64-based Systems Service Pack 1(VBScript 5.8)
MS14-011 Windows 7 for x64-based Systems Service Pack 1(VBScript 5.8)
MS14-011 Windows 7 for x64-based Systems Service Pack 1(VBScript 5.8)
MS14-011 Windows 8 for 32-bit Systems(VBScript 5.8)
MS14-011 Windows 8 for x64-based Systems(VBScript 5.8)
MS14-011 Windows 8.1 for 32-bit Systems(VBScript 5.8)
MS14-011 Windows 8.1 for x64-based Systems(VBScript 5.8)
MS14-011 Windows Server 2003 Service Pack 2(VBScript 5.6)
MS14-011 Windows Server 2003 Service Pack 2(VBScript 5.7)
MS14-011 Windows Server 2003 Service Pack 2(VBScript 5.8)
MS14-011 Windows Server 2003 with SP2 for Itanium-based Systems(VBScript 5.6)
MS14-011 Windows Server 2003 with SP2 for Itanium-based Systems(VBScript 5.7)
MS14-011 Windows Server 2003 x64 Edition Service Pack 2(VBScript 5.6)
MS14-011 Windows Server 2003 x64 Edition Service Pack 2(VBScript 5.7)
MS14-011 Windows Server 2003 x64 Edition Service Pack 2(VBScript 5.8)
MS14-011 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1(VBScript 5.8)
MS14-011 Windows Server 2008 R2 for x64-based Systems Service Pack 1(VBScript 5.8)
MS14-011 Windows Server 2008 R2 for x64-based Systems Service Pack 1(VBScript 5.8)
MS14-011 Windows Server 2008 R2 for x64-based Systems Service Pack 1(VBScript 5.8)
MS14-011 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)(VBScript 5.8)
MS14-011 Windows Server 2008 for 32-bit Systems Service Pack 2(VBScript 5.7)
MS14-011 Windows Server 2008 for 32-bit Systems Service Pack 2(VBScript 5.8)
MS14-011 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)(VBScript 5.7)
MS14-011 Windows Server 2008 for Itanium-based Systems Service Pack 2(VBScript 5.7)
MS14-011 Windows Server 2008 for x64-based Systems Service Pack 2(VBScript 5.7)
MS14-011 Windows Server 2008 for x64-based Systems Service Pack 2(VBScript 5.8)
MS14-011 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)(VBScript 5.7)
MS14-011 Windows Server 2012(VBScript 5.8)
MS14-011 Windows Server 2012 (Server Core installation)(VBScript 5.8)
MS14-011 Windows Server 2012 R2(VBScript 5.8)
MS14-011 Windows Server 2012 R2 (Server Core installation)(VBScript 5.8)
MS14-011 Windows Vista Service Pack 2(VBScript 5.7)
MS14-011 Windows Vista Service Pack 2(VBScript 5.8)
MS14-011 Windows Vista x64 Edition Service Pack 2(VBScript 5.7)
MS14-011 Windows Vista x64 Edition Service Pack 2(VBScript 5.8)
MS14-011 Windows XP Professional x64 Edition Service Pack 2(VBScript 5.6)
MS14-011 Windows XP Professional x64 Edition Service Pack 2(VBScript 5.7)
MS14-011 Windows XP Professional x64 Edition Service Pack 2(VBScript 5.8)
MS14-011 Windows XP Service Pack 3(VBScript 5.7)
MS14-011 Windows XP Service Pack 3(VBScript 5.8)
These new vulnerability checks are included in Qualys vulnerability signature 2.2.651-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 90939
- 90940
- 90938
- 90941
- 90943
- 100178
- 90942
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.