Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 24 vulnerabilities that were fixed in 7 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 7 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Office Remote Code Execution Vulnerability (MS14-082)

  Severity

  Critical 4

  Qualys ID

  110246

  Vendor Reference

  MS14-082

  CVE Reference

  CVE-2014-6364

  CVSS Scores

  Base 9.3 / Temporal 7.3

  Description

  A remote code execution vulnerability exists in the context of the current user that is caused when Microsoft Word does not properly handle objects in memory while parsing specially crafted Office files.

  This security update is rated Important for all supported editions of Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2013 RT.

  Consequence

  The vulnerability could allow remote code execution if a specially crafted file is opened in an affected edition of Microsoft Office. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

  Solution

  Refer to Microsoft Security Bulletin MS14-082 for further details.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS14-082 Microsoft Office 2007 Service Pack 3
  MS14-082 Microsoft Office 2010 Service Pack 2 (32-bit editions)
  MS14-082 Microsoft Office 2010 Service Pack 2 (64-bit editions)
  MS14-082 Microsoft Office 2013 (32-bit editions)
  MS14-082 Microsoft Office 2013 (64-bit editions)
  MS14-082 Microsoft Office 2013 Service Pack 1 (32-bit editions)
  MS14-082 Microsoft Office 2013 Service Pack 1 (64-bit editions)

• Microsoft Excel Remote Code Execution Vulnerabilities (MS14-083)

  Severity

  Critical 4

  Qualys ID

  110245

  Vendor Reference

  MS14-083

  CVE Reference

  CVE-2014-6360, CVE-2014-6361

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft Excel is a proprietary spreadsheet application written and distributed by Microsoft.

  This security update resolves two privately reported vulnerabilities in Microsoft Excel.

  The security update addresses the vulnerabilities by correcting how Microsoft Excel parses specially crafted Office files.

  This security update is rated Important for all supported editions of Microsoft Excel 2007, Microsoft Excel 2010, Microsoft Excel 2013, Microsoft Excel 2013 RT, and Microsoft Office Compatibility Pack.

  Consequence

  These vulnerabilities could allow remote code execution if a user opens a specially crafted Office file. An attacker who successfully exploits these vulnerabilities could gain the same user rights as the logged-on user.

  Solution

  Refer to MS14-083 for further information.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS14-083 Microsoft Office 2007 Service Pack 3(Microsoft Excel 2007 Service Pack 3)
  MS14-083 Microsoft Office 2010 Service Pack 2 (32-bit editions)(Microsoft Excel 2010 Service Pack 2 (32-bit editions))
  MS14-083 Microsoft Office 2010 Service Pack 2 (64-bit editions)(Microsoft Excel 2010 Service Pack 2 (64-bit editions))
  MS14-083 Microsoft Office 2013 (32-bit editions)(Microsoft Excel 2013 (32-bit editions))
  MS14-083 Microsoft Office 2013 (64-bit editions)(Microsoft Excel 2013 (64-bit editions))
  MS14-083 Microsoft Office 2013 Service Pack 1 (32-bit editions)(Microsoft Excel 2013 Service Pack 1 (32-bit editions))
  MS14-083 Microsoft Office 2013 Service Pack 1 (64-bit editions)(Microsoft Excel 2013 Service Pack 1 (64-bit editions))
  MS14-083 Microsoft Office Compatibility Pack Service Pack 3

• Microsoft VBScript Engine Remote Code Execution Vulnerability (MS14-084)

  Severity

  Critical 4

  Qualys ID

  91001

  Vendor Reference

  MS14-084

  CVE Reference

  CVE-2014-6363

  CVSS Scores

  Base 9.3 / Temporal 7.3

  Description

  A remote code execution vulnerability exists in the way that the VBScript engine, when rendered in Internet Explorer, handles objects in memory. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user.

  This security update is rated Critical for affected versions of the VBScript scripting engine on affected Windows clients and Moderate for affected versions of the VBScript scripting engine on affected Windows servers.

  Consequence

  Successfullu exploiting this vulnerability might allow a remote attacker to run arbitrary code on the affected system.

  Solution

  Please refer to MS14-084 for details.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS14-084 Windows 7 for 32-bit Systems Service Pack 1(VBScript 5.8)
  MS14-084 Windows 7 for x64-based Systems Service Pack 1(VBScript 5.8)
  MS14-084 Windows Server 2003 Service Pack 2(VBScript 5.6)
  MS14-084 Windows Server 2003 Service Pack 2(VBScript 5.7)
  MS14-084 Windows Server 2003 Service Pack 2(VBScript 5.8)
  MS14-084 Windows Server 2003 with SP2 for Itanium-based Systems(VBScript 5.6)
  MS14-084 Windows Server 2003 with SP2 for Itanium-based Systems(VBScript 5.7)
  MS14-084 Windows Server 2003 x64 Edition Service Pack 2(VBScript 5.6)
  MS14-084 Windows Server 2003 x64 Edition Service Pack 2(VBScript 5.7)
  MS14-084 Windows Server 2003 x64 Edition Service Pack 2(VBScript 5.8)
  MS14-084 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1(VBScript 5.8)
  MS14-084 Windows Server 2008 R2 for x64-based Systems Service Pack 1(VBScript 5.8)
  MS14-084 Windows Server 2008 R2 for x64-based Systems Service Pack 1(VBScript 5.8)
  MS14-084 Windows Server 2008 for 32-bit Systems Service Pack 2(VBScript 5.7)
  MS14-084 Windows Server 2008 for 32-bit Systems Service Pack 2(VBScript 5.7)
  MS14-084 Windows Server 2008 for 32-bit Systems Service Pack 2(VBScript 5.8)
  MS14-084 Windows Server 2008 for 32-bit Systems Service Pack 2(VBScript 5.8)
  MS14-084 Windows Server 2008 for Itanium-based Systems Service Pack 2(VBScript 5.7)
  MS14-084 Windows Server 2008 for x64-based Systems Service Pack 2(VBScript 5.7)
  MS14-084 Windows Server 2008 for x64-based Systems Service Pack 2(VBScript 5.7)
  MS14-084 Windows Server 2008 for x64-based Systems Service Pack 2(VBScript 5.8)
  MS14-084 Windows Server 2008 for x64-based Systems Service Pack 2(VBScript 5.8)
  MS14-084 Windows Vista Service Pack 2(VBScript 5.7)
  MS14-084 Windows Vista Service Pack 2(VBScript 5.8)
  MS14-084 Windows Vista x64 Edition Service Pack 2(VBScript 5.7)
  MS14-084 Windows Vista x64 Edition Service Pack 2(VBScript 5.8)

• Microsoft Word and Office Web Apps Remote Code Execution Vulnerability (MS14-081)

  Severity

  Critical 4

  Qualys ID

  110244

  Vendor Reference

  MS14-081

  CVE Reference

  CVE-2014-6356, CVE-2014-6357

  CVSS Scores

  Base 9.3 / Temporal 7.3

  Description

  A remote code execution vulnerability exists in the way that Microsoft Office software parses certain properties of Microsoft Word files. Microsoft has released a security update that addresses the vulnerability by correcting the way that Microsoft Office parses specially crafted files.

  This security update is rated Critical for all supported editions of Microsoft Word 2007, Microsoft Office 2010, Microsoft Word 2010, Microsoft Word 2013, Microsoft Word 2013 RT, Microsoft Office for Mac 2011, Microsoft Word Viewer, Microsoft Office Compatibility Pack, and for affected Microsoft Office services and Web Apps on supported editions of Microsoft SharePoint Server 2010, Microsoft SharePoint Server 2013, and Microsoft Office Web Apps Server 2013

  Consequence

  The vulnerabilities could allow remote code execution if an attacker convinces a user to open or preview a specially crafted Microsoft Word file in an affected version of Microsoft Office software.

  Solution

  Refer to Microsoft Security Bulletin MS14-081 for details.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS14-081 Microsoft Office 2007 Service Pack 3(Microsoft Word 2007 Service Pack 3)
  MS14-081 Microsoft Office 2010 Service Pack 2 (32-bit editions)(Microsoft Word 2010 Service Pack 2 (32-bit editions))
  MS14-081 Microsoft Office 2010 Service Pack 2 (32-bit editions)
  MS14-081 Microsoft Office 2010 Service Pack 2 (64-bit editions)(Microsoft Word 2010 Service Pack 2 (64-bit editions))
  MS14-081 Microsoft Office 2010 Service Pack 2 (64-bit editions)
  MS14-081 Microsoft Office 2013 (32-bit editions)(Microsoft Word 2013 (32-bit editions))
  MS14-081 Microsoft Office 2013 (64-bit editions)(Microsoft Word 2013 (64-bit editions))
  MS14-081 Microsoft Office 2013 Service Pack 1 (32-bit editions)(Microsoft Word 2013 Service Pack 1 (32-bit editions))
  MS14-081 Microsoft Office 2013 Service Pack 1 (64-bit editions)(Microsoft Word 2013 Service Pack 1 (64-bit editions))
  MS14-081 Microsoft Office Compatibility Pack Service Pack 3
  MS14-081 Microsoft Office Web Apps 2010 Service Pack 2(Microsoft Web Applications 2010 Service Pack 2)
  MS14-081 Microsoft Office Web Apps 2013(Microsoft Office Web Apps Server 2013)
  MS14-081 Microsoft Office Web Apps 2013 Service Pack 1(Microsoft Office Web Apps Server 2013 Service Pack 1)
  MS14-081 Microsoft Office for Mac 2011
  MS14-081 Microsoft SharePoint Server 2010 Service Pack 2(Word Automation Services)
  MS14-081 Microsoft SharePoint Server 2013(Word Automation Services)
  MS14-081 Microsoft SharePoint Server 2013 Service Pack 1(Word Automation Services)
  MS14-081 Microsoft Word Viewer

• Microsoft Exchange Server Elevation of Privilege Vulnerabilities (MS14-075)

  Severity

  Critical 4

  Qualys ID

  74274

  Vendor Reference

  MS14-075

  CVE Reference

  CVE-2014-6319, CVE-2014-6325, CVE-2014-6326, CVE-2014-6336

  CVSS Scores

  Base 5 / Temporal 3.7

  Description

  This security update resolves four privately reported vulnerabilities in Microsoft Exchange Server. The most severe of these vulnerabilities could allow elevation of privilege if a user clicks a specially crafted URL that takes them to a targeted Outlook Web App site.

  A token spoofing vulnerability exists in Exchange Server when Microsoft Outlook Web App (OWA) fails to properly validate a request token.

  Elevation of privilege vulnerabilities exist when Microsoft Exchange Server does not properly validate input.

  A spoofing vulnerability exists in Microsoft Exchange when Microsoft Outlook Web App (OWA) fails to properly validate redirection tokens.

  Affected Software:
  Microsoft Exchange Server 2007 Service Pack 3
  Microsoft Exchange Server 2010 Service Pack 3
  Microsoft Exchange Server 2013 Service Pack 1
  Microsoft Exchange Server 2013 Cumulative Update 6

  This security update is rated Important for all supported editions of Microsoft Exchange Server 2007, Microsoft Exchange Server 2010, and Microsoft Exchange Server 2013.
  Note:Due to an issue with a Microsoft security update for Microsoft Exchange Server 2010 Service Pack 3, Microsoft recommends that customers uninstall update 2986475 if they have already installed it. A patch will be released later to mitigate this vulnerability

  Consequence

  An attacker who successfully exploited these vulnerabilities can run script in the context of the current user. An attacker can, for example, read content that the attacker is not authorized to read, use the victim's identity to take actions on the Outlook Web App site on behalf of the victim, such as change permissions and delete content, and inject malicious content in the browser of the victim. Any system that is used to access an affected version of Outlook Web App would potentially be at risk to attack.

  Solution

  Refer to Microsoft Security Bulletin MS14-075 for further details.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS14-075 Microsoft Exchange Server 2007 Service Pack 3
  MS14-075 Microsoft Exchange Server 2010 Service Pack 3
  MS14-075 Microsoft Exchange Server 2013 Cumulative Update 6
  MS14-075 Microsoft Exchange Server 2013 Service Pack 1

• Microsoft Internet Explorer Cumulative Security Update (MS14-080)

  Severity

  Urgent 5

  Qualys ID

  100218

  Vendor Reference

  MS14-080

  CVE Reference

  CVE-2014-6327, CVE-2014-6328, CVE-2014-6329, CVE-2014-6330, CVE-2014-6363, CVE-2014-6365, CVE-2014-6366, CVE-2014-6368, CVE-2014-6369, CVE-2014-6373, CVE-2014-6374, CVE-2014-6375, CVE-2014-6376, CVE-2014-8966

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft Internet Explorer is a graphical web browser developed by Microsoft and included as part of the Microsoft Windows operating systems.

  - Remote code execution vulnerabilities exist when Internet Explorer improperly accesses objects in memory.

  - XSS filter bypass vulnerabilities exist in the way that Internet Explorer disables an HTML attribute in otherwise appropriately filtered HTTP response data.

  - A security feature bypass vulnerability exists when Internet Explorer does not use the Address Space Layout Randomization (ASLR) security feature, allowing an attacker to more reliably predict the memory offsets of specific instructions in a given call stack.

  - A remote code execution vulnerability exists in the way that the VBScript engine, when rendered in Internet Explorer, handles objects in memory.

  This security update is rated Critical for Internet Explorer 6 (IE 6), Internet Explorer 7 (IE 7), Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows clients, and Moderate for Internet Explorer 6 (IE 6), Internet Explorer 7 (IE 7), Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows servers.

  Consequence

  An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited these vulnerabilities could take complete control of an affected system.

  Solution

  Refer to Microsoft Security Bulletin MS14-080 for details.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS14-080 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 10)
  MS14-080 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 11)
  MS14-080 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 8)
  MS14-080 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 9)
  MS14-080 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 10)
  MS14-080 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 11)
  MS14-080 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 8)
  MS14-080 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 9)
  MS14-080 Windows 8 for 32-bit Systems(Internet Explorer 10)
  MS14-080 Windows 8 for x64-based Systems(Internet Explorer 10)
  MS14-080 Windows 8.1 for 32-bit Systems(Internet Explorer 11)
  MS14-080 Windows 8.1 for x64-based Systems(Internet Explorer 11)
  MS14-080 Windows Server 2003 Service Pack 2(Internet Explorer 6)
  MS14-080 Windows Server 2003 Service Pack 2(Internet Explorer 7)
  MS14-080 Windows Server 2003 Service Pack 2(Internet Explorer 8)
  MS14-080 Windows Server 2003 with SP2 for Itanium-based Systems(Internet Explorer 6)
  MS14-080 Windows Server 2003 with SP2 for Itanium-based Systems(Internet Explorer 7)
  MS14-080 Windows Server 2003 x64 Edition Service Pack 2(Internet Explorer 6)
  MS14-080 Windows Server 2003 x64 Edition Service Pack 2(Internet Explorer 7)
  MS14-080 Windows Server 2003 x64 Edition Service Pack 2(Internet Explorer 8)
  MS14-080 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1(Internet Explorer 8)
  MS14-080 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 10)
  MS14-080 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 11)
  MS14-080 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 8)
  MS14-080 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 9)
  MS14-080 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 7)
  MS14-080 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 8)
  MS14-080 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 9)
  MS14-080 Windows Server 2008 for Itanium-based Systems Service Pack 2(Internet Explorer 7)
  MS14-080 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 7)
  MS14-080 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 8)
  MS14-080 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 9)
  MS14-080 Windows Server 2012(Internet Explorer 10)
  MS14-080 Windows Server 2012 R2(Internet Explorer 11)
  MS14-080 Windows Vista Service Pack 2(Internet Explorer 7)
  MS14-080 Windows Vista Service Pack 2(Internet Explorer 8)
  MS14-080 Windows Vista Service Pack 2(Internet Explorer 9)
  MS14-080 Windows Vista x64 Edition Service Pack 2(Internet Explorer 7)
  MS14-080 Windows Vista x64 Edition Service Pack 2(Internet Explorer 8)
  MS14-080 Windows Vista x64 Edition Service Pack 2(Internet Explorer 9)

• Microsoft Graphics Component Information Disclosure (MS14-085)

  Severity

  Serious 3

  Qualys ID

  91000

  Vendor Reference

  MS14-085

  CVE Reference

  CVE-2014-6355

  CVSS Scores

  Base 5 / Temporal 4.1

  Description

  An information disclosure vulnerability exists in the Microsoft Graphics Component that could allow an attacker to more reliably predict the memory offsets of specific instructions in a given call stack.

  The vulnerability could disclose information if a user browses to a website containing specially crafted JPEG content.

  This security update is rated Important for all supported editions of Windows Server 2003, Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8 and Windows 8.1, Windows Server 2012 and Windows Server 2012 R2, Windows RT and Windows RT 8.1

  Consequence

  An attacker could use this information disclosure vulnerability to gain information about the system that could then be combined with other attacks to compromise the system.

  Solution

  Refer to MS14-085 for further information.

  Workaround:
  Microsoft has not identified any workarounds for this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS14-085 Windows 7 for 32-bit Systems Service Pack 1
  MS14-085 Windows 7 for x64-based Systems Service Pack 1
  MS14-085 Windows 8 for 32-bit Systems
  MS14-085 Windows 8 for x64-based Systems
  MS14-085 Windows 8.1 for 32-bit Systems
  MS14-085 Windows 8.1 for x64-based Systems
  MS14-085 Windows Server 2003 Service Pack 2
  MS14-085 Windows Server 2003 with SP2 for Itanium-based Systems
  MS14-085 Windows Server 2003 x64 Edition Service Pack 2
  MS14-085 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
  MS14-085 Windows Server 2008 R2 for x64-based Systems Service Pack 1
  MS14-085 Windows Server 2008 R2 for x64-based Systems Service Pack 1
  MS14-085 Windows Server 2008 for 32-bit Systems Service Pack 2
  MS14-085 Windows Server 2008 for 32-bit Systems Service Pack 2
  MS14-085 Windows Server 2008 for Itanium-based Systems Service Pack 2
  MS14-085 Windows Server 2008 for x64-based Systems Service Pack 2
  MS14-085 Windows Server 2008 for x64-based Systems Service Pack 2
  MS14-085 Windows Server 2012
  MS14-085 Windows Server 2012
  MS14-085 Windows Server 2012 R2
  MS14-085 Windows Server 2012 R2
  MS14-085 Windows Vista Service Pack 2
  MS14-085 Windows Vista x64 Edition Service Pack 2

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.