Microsoft’s August Advisory Includes Critical Security Updates

August 12, 2014 | By Kevin Judge

If it’s the second Tuesday of the month, it is time for Microsoft’s Security Updates, aka “Patch Tuesday”.

The Microsoft August 2014 Security Bulletin includes critical security updates to address vulnerabilities in Windows, Office, SQL Server, Server Software, .NET Framework, and Internet Explorer. Some of these vulnerabilities could allow remote code execution, elevation of privilege, or security feature bypass.

Microsoft’s security update process has garnered closer attention since support ended for their Windows XP operating system last April. Despite a concerted effort by Microsoft to move users off of XP, a quarter of all desktop computers and 90% of all ATM machines run on Windows XP .

Highlights of the August Advisory

The August advisory addresses issues that include the following:

  • The security update for Windows Explorer addresses vulnerabilities that an attacker could be exploited to gain the same user rights as the current user. These vulnerabilities could allow remote code execution if a user views a hacker designed webpage using Internet Explore
  • A vulnerability in Windows Media Center that could allow remote code execution if a user opens a Microsoft Office file designed by a hacker to invoke Windows Media Center resources.
  • A vulnerability in OneNote that could allow remote code execution if a file designed by hacker isopened in an affected version of Microsoft OneNote
  • Vulnerabilities in SQL Server that could allow elevation of user privileges.
  • Vulnerabilities in the Kernel-Mode drivers that could allow the elevation of privileges. An attacker must have valid logon credentials and be able to log on locally to exploit these vulnerabilities.
  • Vulnerabilities in Microsoft Windows Installer that could allow the elevation of privileges. An attacker must have valid logon credentials and be able to log on locally to exploit these vulnerabilities.
  • A vulnerability in Microsoft SharePoint Server that could allow the elevation of privileges. An attacker could exploit this to run malicious Javascript in the context of the user.
  • A vulnerability in .NET Framework that could allow security feature bypass if a user visits a specially crafted web site. An attacker must use the vulnerability in conjunction with another vulnerability, such as a remote code execution vulnerability, that takes advantage of the ASLR bypass to run arbitrary code.
  • A vulnerability in LRPC that could allow security feature bypass. An attacker must use the vulnerability in conjunction with another vulnerability, such as a remote code execution vulnerability, that takes advantage of the ASLR bypass to run arbitrary code.
Be Sociable, Share!

    Add new comment

    Your name
    Comment

    You may use these HTML tags and attributes: <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>