Qualys Vulnerability R&D Lab has released new vulnerability checks in the Qualys Cloud Platform to protect organizations against 33 vulnerabilities that were fixed in 14 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Microsoft has released 14 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
A remote code execution vulnerability exists in the Secure Channel (Schannel) security package due to the improper processing of specially crafted packets (CVE-2014-6321).
This security update is rated Critical for all supported releases of Microsoft Windows.
Refer to MS14-066 for further information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-066 Windows 7 for 32-bit Systems Service Pack 1
MS14-066 Windows 7 for x64-based Systems Service Pack 1
MS14-066 Windows 8 for 32-bit Systems
MS14-066 Windows 8 for x64-based Systems
MS14-066 Windows 8.1 for 32-bit Systems
MS14-066 Windows 8.1 for x64-based Systems
MS14-066 Windows Server 2003 Service Pack 2
MS14-066 Windows Server 2003 with SP2 for Itanium-based Systems
MS14-066 Windows Server 2003 x64 Edition Service Pack 2
MS14-066 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS14-066 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS14-066 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS14-066 Windows Server 2008 for 32-bit Systems Service Pack 2
MS14-066 Windows Server 2008 for 32-bit Systems Service Pack 2
MS14-066 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS14-066 Windows Server 2008 for x64-based Systems Service Pack 2
MS14-066 Windows Server 2008 for x64-based Systems Service Pack 2
MS14-066 Windows Server 2012
MS14-066 Windows Server 2012
MS14-066 Windows Server 2012 R2
MS14-066 Windows Server 2012 R2
MS14-066 Windows Vista Service Pack 2
MS14-066 Windows Vista x64 Edition Service Pack 2
This security update is rated Important for supported editions of Microsoft SharePoint Foundation 2010.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-073 Microsoft SharePoint Server 2010 Service Pack 2(Microsoft SharePoint Foundation 2010 Service Pack 2)
Note: Windows XP is end of life and is vulnerable to this issue. For further details see Exploits Against Obsolete Software.
Workaround:
- Apply the Microsoft Fix it solution "OLE packager Shim Workaround".
- Do not open Microsoft PowerPoint files that you receive from untrusted sources or that you receive unexpectedly from trusted sources.
Refer to the following link for further details:
Microsoft Security Advisory 3010060
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-064 Windows 7 for 32-bit Systems Service Pack 1
MS14-064 Windows 7 for 32-bit Systems Service Pack 1
MS14-064 Windows 7 for x64-based Systems Service Pack 1
MS14-064 Windows 7 for x64-based Systems Service Pack 1
MS14-064 Windows 8 for 32-bit Systems
MS14-064 Windows 8 for 32-bit Systems
MS14-064 Windows 8 for x64-based Systems
MS14-064 Windows 8 for x64-based Systems
MS14-064 Windows 8.1 for 32-bit Systems
MS14-064 Windows 8.1 for 32-bit Systems
MS14-064 Windows 8.1 for x64-based Systems
MS14-064 Windows 8.1 for x64-based Systems
MS14-064 Windows Server 2003 Service Pack 2
MS14-064 Windows Server 2003 with SP2 for Itanium-based Systems
MS14-064 Windows Server 2003 x64 Edition Service Pack 2
MS14-064 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS14-064 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS14-064 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS14-064 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS14-064 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS14-064 Windows Server 2008 for 32-bit Systems Service Pack 2
MS14-064 Windows Server 2008 for 32-bit Systems Service Pack 2
MS14-064 Windows Server 2008 for 32-bit Systems Service Pack 2
MS14-064 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS14-064 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS14-064 Windows Server 2008 for x64-based Systems Service Pack 2
MS14-064 Windows Server 2008 for x64-based Systems Service Pack 2
MS14-064 Windows Server 2008 for x64-based Systems Service Pack 2
MS14-064 Windows Server 2012
MS14-064 Windows Server 2012
MS14-064 Windows Server 2012
MS14-064 Windows Server 2012 R2
MS14-064 Windows Server 2012 R2
MS14-064 Windows Server 2012 R2
MS14-064 Windows Vista Service Pack 2
MS14-064 Windows Vista Service Pack 2
MS14-064 Windows Vista x64 Edition Service Pack 2
MS14-064 Windows Vista x64 Edition Service Pack 2
- Remote code execution vulnerabilities exist when Internet Explorer improperly accesses objects in memory.
- Elevation of privilege vulnerabilities exist when Internet Explorer does not properly validate permissions under specific conditions, potentially allowing script to be run with elevated privileges.
- Information disclosure vulnerabilities exist when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to gain access to information in another domain or Internet Explorer zone.
- An information disclosure vulnerability exists when Internet Explorer does not properly restrict access to the clipboard of a user who visits a website.
- A security feature bypass vulnerability exists when Internet Explorer does not use the Address Space Layout Randomization (ASLR) security feature, which could allow an attacker to more reliably predict the memory offsets of specific instructions in a given call stack.
This security update is rated Critical for Internet Explorer 6 (IE 6), Internet Explorer 7 (IE 7), Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows clients, and Moderate for Internet Explorer 6 (IE 6), Internet Explorer 7 (IE 7), Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows servers.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-065 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 10)
MS14-065 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 11)
MS14-065 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 8)
MS14-065 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 9)
MS14-065 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 10)
MS14-065 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 11)
MS14-065 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 8)
MS14-065 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 9)
MS14-065 Windows 8 for 32-bit Systems(Internet Explorer 10)
MS14-065 Windows 8 for x64-based Systems(Internet Explorer 10)
MS14-065 Windows 8.1 for 32-bit Systems(Internet Explorer 11)
MS14-065 Windows 8.1 for x64-based Systems(Internet Explorer 11)
MS14-065 Windows Server 2003 Service Pack 2(Internet Explorer 6)
MS14-065 Windows Server 2003 Service Pack 2(Internet Explorer 7)
MS14-065 Windows Server 2003 Service Pack 2(Internet Explorer 8)
MS14-065 Windows Server 2003 with SP2 for Itanium-based Systems(Internet Explorer 6)
MS14-065 Windows Server 2003 with SP2 for Itanium-based Systems(Internet Explorer 7)
MS14-065 Windows Server 2003 x64 Edition Service Pack 2(Internet Explorer 6)
MS14-065 Windows Server 2003 x64 Edition Service Pack 2(Internet Explorer 7)
MS14-065 Windows Server 2003 x64 Edition Service Pack 2(Internet Explorer 8)
MS14-065 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1(Internet Explorer 8)
MS14-065 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 10)
MS14-065 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 11)
MS14-065 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 8)
MS14-065 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 9)
MS14-065 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 7)
MS14-065 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 8)
MS14-065 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 9)
MS14-065 Windows Server 2008 for Itanium-based Systems Service Pack 2(Internet Explorer 7)
MS14-065 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 7)
MS14-065 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 8)
MS14-065 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 9)
MS14-065 Windows Server 2012(Internet Explorer 10)
MS14-065 Windows Server 2012 R2(Internet Explorer 11)
MS14-065 Windows Vista Service Pack 2(Internet Explorer 7)
MS14-065 Windows Vista Service Pack 2(Internet Explorer 8)
MS14-065 Windows Vista Service Pack 2(Internet Explorer 9)
MS14-065 Windows Vista x64 Edition Service Pack 2(Internet Explorer 7)
MS14-065 Windows Vista x64 Edition Service Pack 2(Internet Explorer 8)
MS14-065 Windows Vista x64 Edition Service Pack 2(Internet Explorer 9)
This security update resolves a privately reported vulnerability in Microsoft Windows.
This security update for Microsoft XML Core Services 3.0 is rated Critical for affected releases of Microsoft Windows clients and Important for affected releases of Microsoft Windows servers.
Workaround:
Prevent MSXML 3.0 binary behaviors from being used in Internet Explorer
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-067 Windows 7 for 32-bit Systems Service Pack 1
MS14-067 Windows 7 for x64-based Systems Service Pack 1
MS14-067 Windows 8 for 32-bit Systems
MS14-067 Windows 8 for x64-based Systems
MS14-067 Windows 8.1 for 32-bit Systems
MS14-067 Windows 8.1 for x64-based Systems
MS14-067 Windows Server 2003 Service Pack 2
MS14-067 Windows Server 2003 with SP2 for Itanium-based Systems
MS14-067 Windows Server 2003 x64 Edition Service Pack 2
MS14-067 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS14-067 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS14-067 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS14-067 Windows Server 2008 for 32-bit Systems Service Pack 2
MS14-067 Windows Server 2008 for 32-bit Systems Service Pack 2
MS14-067 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS14-067 Windows Server 2008 for x64-based Systems Service Pack 2
MS14-067 Windows Server 2008 for x64-based Systems Service Pack 2
MS14-067 Windows Server 2012
MS14-067 Windows Server 2012
MS14-067 Windows Server 2012 R2
MS14-067 Windows Server 2012 R2
MS14-067 Windows Vista Service Pack 2
MS14-067 Windows Vista x64 Edition Service Pack 2
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-069 Microsoft Office 2007 Service Pack 3(Microsoft Word 2007 Service Pack 3)
MS14-069 Microsoft Office Compatibility Pack Service Pack 3
MS14-069 Microsoft Word Viewer
An elevation of privilege vulnerability exists in the Windows TCP/IP stack (tcpip.sys, tcpip6.sys) that is caused when the Windows TCP/IP stack fails to properly handle objects in memory during IOCTL processing.
Affected Software:
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Service Pack 2
This security update is rated Important.
Refer to MS14-070 for further information.
Workaround:
Microsoft has not identified any workarounds for this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
/MS14-070 Windows
Affected Software:
Windows Vista Service Pack 2
Windows Server 2008 Service Pack 2
Windows 7 Service Pack 1
Windows Server 2008 R2 Service Pack 1
Windows 8
Windows Server 2012
Windows RT
Windows RT 8.1
This security update is rated Important.
Refer to MS14-071 for further information.
Workaround:
Microsoft has not identified any workarounds for this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-071 Windows 7 for 32-bit Systems Service Pack 1
MS14-071 Windows 7 for x64-based Systems Service Pack 1
MS14-071 Windows 8 for 32-bit Systems
MS14-071 Windows 8 for x64-based Systems
MS14-071 Windows 8.1 for 32-bit Systems
MS14-071 Windows 8.1 for x64-based Systems
MS14-071 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS14-071 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS14-071 Windows Server 2008 for 32-bit Systems Service Pack 2
MS14-071 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS14-071 Windows Server 2008 for x64-based Systems Service Pack 2
MS14-071 Windows Server 2012
MS14-071 Windows Server 2012 R2
MS14-071 Windows Vista Service Pack 2
MS14-071 Windows Vista x64 Edition Service Pack 2
An elevation of privilege vulnerability exists in the way that .NET Framework handles TypeFilterLevel checks for some malformed objects (CVE-2014-4142).
This security update is rated Important for Microsoft .NET Framework 1.1 Service Pack 1, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4, Microsoft .NET Framework 4.5, Microsoft .NET Framework 4.5.1, and Microsoft .NET Framework 4.5.2 on affected releases of Microsoft Windows.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-072 Windows 7 for 32-bit Systems Service Pack 1(Microsoft .NET Framework 3.5.1)
MS14-072 Windows 7 for 32-bit Systems Service Pack 1(Microsoft .NET Framework 4)
MS14-072 Windows 7 for 32-bit Systems Service Pack 1(Microsoft .NET Framework 4.5/4.5.1/4.5.2)
MS14-072 Windows 7 for x64-based Systems Service Pack 1(Microsoft .NET Framework 3.5.1)
MS14-072 Windows 7 for x64-based Systems Service Pack 1(Microsoft .NET Framework 4)
MS14-072 Windows 7 for x64-based Systems Service Pack 1(Microsoft .NET Framework 4.5/4.5.1/4.5.2)
MS14-072 Windows 8 for 32-bit Systems(Microsoft .NET Framework 3.5)
MS14-072 Windows 8 for 32-bit Systems(Microsoft .NET Framework 4.5/4.5.1/4.5.2)
MS14-072 Windows 8 for x64-based Systems(Microsoft .NET Framework 3.5)
MS14-072 Windows 8 for x64-based Systems(Microsoft .NET Framework 4.5/4.5.1/4.5.2)
MS14-072 Windows 8.1 for 32-bit Systems(Microsoft .NET Framework 3.5)
MS14-072 Windows 8.1 for 32-bit Systems(Microsoft .NET Framework 4.5.1/4.5.2)
MS14-072 Windows 8.1 for x64-based Systems(Microsoft .NET Framework 3.5)
MS14-072 Windows 8.1 for x64-based Systems(Microsoft .NET Framework 4.5.1/4.5.2)
MS14-072 Windows Server 2003 Service Pack 2(Microsoft .NET Framework 1.1 Service Pack 1)
MS14-072 Windows Server 2003 Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-072 Windows Server 2003 Service Pack 2(Microsoft .NET Framework 4)
MS14-072 Windows Server 2003 with SP2 for Itanium-based Systems(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-072 Windows Server 2003 with SP2 for Itanium-based Systems(Microsoft .NET Framework 4)
MS14-072 Windows Server 2003 x64 Edition Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-072 Windows Server 2003 x64 Edition Service Pack 2(Microsoft .NET Framework 4)
MS14-072 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1(Microsoft .NET Framework 3.5.1)
MS14-072 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1(Microsoft .NET Framework 4)
MS14-072 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Microsoft .NET Framework 3.5.1)
MS14-072 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Microsoft .NET Framework 4)
MS14-072 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Microsoft .NET Framework 4.5/4.5.1/4.5.2)
MS14-072 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)(Microsoft .NET Framework 3.5.1)
MS14-072 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)(Microsoft .NET Framework 4)
MS14-072 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)(Microsoft .NET Framework 4.5/4.5.1/4.5.2)
MS14-072 Windows Server 2008 for 32-bit Systems Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-072 Windows Server 2008 for 32-bit Systems Service Pack 2(Microsoft .NET Framework 4)
MS14-072 Windows Server 2008 for 32-bit Systems Service Pack 2(Microsoft .NET Framework 4.5/4.5.1/4.5.2)
MS14-072 Windows Server 2008 for Itanium-based Systems Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-072 Windows Server 2008 for Itanium-based Systems Service Pack 2(Microsoft .NET Framework 4)
MS14-072 Windows Server 2008 for x64-based Systems Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-072 Windows Server 2008 for x64-based Systems Service Pack 2(Microsoft .NET Framework 4)
MS14-072 Windows Server 2008 for x64-based Systems Service Pack 2(Microsoft .NET Framework 4.5/4.5.1/4.5.2)
MS14-072 Windows Server 2012(Microsoft .NET Framework 3.5)
MS14-072 Windows Server 2012(Microsoft .NET Framework 4.5/4.5.1/4.5.2)
MS14-072 Windows Server 2012 (Server Core installation)(Microsoft .NET Framework 3.5)
MS14-072 Windows Server 2012 (Server Core installation)(Microsoft .NET Framework 4.5/4.5.1/4.5.2)
MS14-072 Windows Server 2012 R2(Microsoft .NET Framework 3.5)
MS14-072 Windows Server 2012 R2(Microsoft .NET Framework 4.5.1/4.5.2)
MS14-072 Windows Server 2012 R2 (Server Core installation)(Microsoft .NET Framework 3.5)
MS14-072 Windows Server 2012 R2 (Server Core installation)(Microsoft .NET Framework 4.5.1/4.5.2)
MS14-072 Windows Vista Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-072 Windows Vista Service Pack 2(Microsoft .NET Framework 4)
MS14-072 Windows Vista Service Pack 2(Microsoft .NET Framework 4.5/4.5.1/4.5.2)
MS14-072 Windows Vista x64 Edition Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2)
MS14-072 Windows Vista x64 Edition Service Pack 2(Microsoft .NET Framework 4)
MS14-072 Windows Vista x64 Edition Service Pack 2(Microsoft .NET Framework 4.5/4.5.1/4.5.2)
A security feature bypass vulnerability exists in Remote Desktop Protocol (RDP) when RDP does not properly log failed logon attempts.
This security update is rated Important for all supported editions of Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows RT, Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1.
Refer to MS14-074 for further information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-074 Windows 7 for 32-bit Systems Service Pack 1
MS14-074 Windows 7 for x64-based Systems Service Pack 1
MS14-074 Windows 8 for 32-bit Systems
MS14-074 Windows 8 for x64-based Systems
MS14-074 Windows 8.1 for 32-bit Systems
MS14-074 Windows 8.1 for x64-based Systems
MS14-074 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS14-074 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS14-074 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS14-074 Windows Server 2008 for 32-bit Systems Service Pack 2
MS14-074 Windows Server 2008 for 32-bit Systems Service Pack 2
MS14-074 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS14-074 Windows Server 2008 for x64-based Systems Service Pack 2
MS14-074 Windows Server 2008 for x64-based Systems Service Pack 2
MS14-074 Windows Server 2012
MS14-074 Windows Server 2012
MS14-074 Windows Server 2012 R2
MS14-074 Windows Server 2012 R2
MS14-074 Windows Vista Service Pack 2
MS14-074 Windows Vista x64 Edition Service Pack 2
Microsoft has released a security update that addresses the vulnerability by changing how IIS handles requests when specific IP and domain restriction configurations exist.
This security update is rated Important for all supported editions of Microsoft Windows 8, Windows 8.1, Windows Server 2012, and Windows Server 2012 R2 RTM
Workaround:
Leverage router/firewall rule sets to deny incoming requests from wildcard domain
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-076 Windows 8 for 32-bit Systems(Microsoft Internet Information Services 8.0)
MS14-076 Windows 8 for x64-based Systems(Microsoft Internet Information Services 8.0)
MS14-076 Windows 8.1 for 32-bit Systems(Microsoft Internet Information Services 8.5)
MS14-076 Windows 8.1 for x64-based Systems(Microsoft Internet Information Services 8.5)
MS14-076 Windows Server 2012(Microsoft Internet Information Services 8.0)
MS14-076 Windows Server 2012 R2(Microsoft Internet Information Services 8.5)
This security update is rated Important for the following:
AD FS 2.0 when installed on 32-bit and x64-based editions of Windows Server 2008
AD FS 2.0 when installed on x64-based editions of Windows Server 2008 R2
AD FS 2.1 when installed on x64-based editions of Windows Server 2012
AD FS 3.0 when installed on x64-based editions of Windows Server 2012 R2
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-077 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Active Directory Federation Services 2.0)
MS14-077 Windows Server 2008 for 32-bit Systems Service Pack 2(Active Directory Federation Services 2.0)
MS14-077 Windows Server 2008 for x64-based Systems Service Pack 2(Active Directory Federation Services 2.0)
MS14-077 Windows Server 2012(Active Directory Federation Services 2.1)
MS14-077 Windows Server 2012 R2(Active Directory Federation Services 3.0)
MS14-077 Windows Server 2012 R2 (Server Core installation)(Active Directory Federation Services 3.0)
The security update addresses the vulnerability by correcting how the Microsoft IME (Japanese) component loads dictionary files that are associated with the vulnerability.
This security update is rated Moderate on all supported editions of Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2; it is also rated Moderate for all supported editions of Microsoft Office 2007 where Microsoft IME (Japanese) is installed.
Workaround:
Use the Enhanced Mitigation Experience Toolkit (EMET)
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-078 Microsoft Office 2007 Service Pack 3(Microsoft Office 2007 IME (Japanese))
MS14-078 Windows 7 for 32-bit Systems Service Pack 1
MS14-078 Windows 7 for x64-based Systems Service Pack 1
MS14-078 Windows Server 2003 Service Pack 2
MS14-078 Windows Server 2003 with SP2 for Itanium-based Systems
MS14-078 Windows Server 2003 x64 Edition Service Pack 2
MS14-078 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS14-078 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS14-078 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS14-078 Windows Server 2008 for 32-bit Systems Service Pack 2
MS14-078 Windows Server 2008 for 32-bit Systems Service Pack 2
MS14-078 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS14-078 Windows Server 2008 for x64-based Systems Service Pack 2
MS14-078 Windows Server 2008 for x64-based Systems Service Pack 2
MS14-078 Windows Vista Service Pack 2
MS14-078 Windows Vista x64 Edition Service Pack 2
Microsoft has released an update that addresses this vulnerability by ensuring that the Windows kernel-mode driver properly validates array indexes when loading TrueType font files.
This security update is rated Moderate for all supported releases of Microsoft Windows.
Workaround:
Deny access to T2EMBED.DLL
Impact of workaround: Applications that rely on embedded font technology will fail to display properly.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS14-079 Windows 7 for 32-bit Systems Service Pack 1
MS14-079 Windows 7 for x64-based Systems Service Pack 1
MS14-079 Windows 8 for 32-bit Systems
MS14-079 Windows 8 for x64-based Systems
MS14-079 Windows 8.1 for 32-bit Systems
MS14-079 Windows 8.1 for x64-based Systems
MS14-079 Windows Server 2003 Service Pack 2
MS14-079 Windows Server 2003 with SP2 for Itanium-based Systems
MS14-079 Windows Server 2003 x64 Edition Service Pack 2
MS14-079 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS14-079 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS14-079 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS14-079 Windows Server 2008 for 32-bit Systems Service Pack 2
MS14-079 Windows Server 2008 for 32-bit Systems Service Pack 2
MS14-079 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS14-079 Windows Server 2008 for x64-based Systems Service Pack 2
MS14-079 Windows Server 2008 for x64-based Systems Service Pack 2
MS14-079 Windows Server 2012
MS14-079 Windows Server 2012
MS14-079 Windows Server 2012 R2
MS14-079 Windows Server 2012 R2
MS14-079 Windows Vista Service Pack 2
MS14-079 Windows Vista x64 Edition Service Pack 2
These new vulnerability checks are included in Qualys vulnerability signature 2.2.863-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
To perform a selective vulnerability scan, configure a scan profile to use the following options:
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Platforms and Platform Identification
For more information, customers may contact Qualys Technical Support.
The Qualys Cloud Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.