Assessing Risk for the October 2014 Security Updates
Today we released eight security bulletins addressing 24 unique CVE’s. Three bulletins have a maximum severity rating of Critical, and five have a maximum severity rating of Important. This table is designed to help you prioritize the deployment of updates appropriately for your environment.
| Bulletin | Most likely attack vector | Max Bulletin Severity | Max exploitability | Platform mitigations and key notes |
|---|---|---|---|---|
| MS14-058(Kernel mode drivers [win32k.sys]) |
Attacker loads a malicious font on the user’s computer using an Office document or web browser which results in remote code execution.
|
Critical
|
0Exploitation of CVE-2014-4148 and CVE-2014-4113 detected in the wild. CVE-2014-4148 is used for remote code execution. CVE-2014-4113 is used for elevation of privilege.
|
CVE-2014-4113 is not exploitable on 32bit platforms if NULL-page mapping mitigation is enabled (configurable on Windows 7, enabled by default on Windows 8 an above).
|
| MS14-056(Internet Explorer) |
Victim browses to a malicious webpage.
|
Critical
|
0Exploitation of CVE-2014-4123 detected in the wild. Used as a sandbox escape.
|
No remote code execution vulnerabilities being addressed in this update are known to be under active attack.
|
| MS14-057(.NET Framework) |
An attacker sends malicious data to a vulnerable web application.
|
Critical
|
1
|
|
| MS14-060(Windows OLE Component) |
Victim opens malicious Office document that exploits the vulnerability resulting in a malicious executable being run.
|
Important
|
0Exploitation of CVE-2014-4114 detected in the wild.
|
Using a non-administrator account or setting UAC to “Always Prompt” helps mitigate the impact of this vulnerability.
|
| MS14-061(Word) |
Victim opens a malicious Word document.
|
Important
|
1
|
|
| MS14-062(Kernel mode drivers [msmq.sys]) |
Attacker running code at low privilege runs exploit binary to elevate to SYSTEM.
|
Important
|
1
|
This vulnerability only affects Windows Server 2003.
|
| MS14-063(Kernel mode drivers [fastfat.sys]) |
Important
|
2
|
Requires the ability to physically plug a USB stick in to the computer.
|
|
| MS14-059(ASP.NET MVC) |
Victim opens a malicious link
|
Important
|
3
|
This is a Cross Site Scripting vulnerability. The XSS Filter, which is enabled by default in IE8-IE11 in the Internet Zone, prevents attempts to exploit this vulnerability.
|
- Joe Bialek and Suha Can, MSRC Engineering