Patch Tuesday: Microsoft Security Bulletin Summary for November 2014

This month Microsoft Patch Tuesday November 2014 has released 14 security bulletins addressing a total of 33 vulnerabilities. The high priority fix is for Windows OLE, Internet Explorer, Windows Schannel and XML Core Services. Internet Explorer alone addresses 17 out of 33 vulnerabilities and it includes fix for 0-day vulnerability CVE-2014-6352 in the Windows OLE.

This month Four bulletins are rated as Critical, addressing 21 vulnerabilities. Eight are rated as Important and two are moderate.

Critical security updates addresses security issues in Windows OLE, Internet Explorer 6 to Internet Explorer 11, Microsoft Schannel and MSXML Core Services. All of them potentially allow Remote Code Execution and even though Microsoft Office is marked as Important it allows Remote Code Execution. Overall Five out of 14 bulletins allow Remote Code Execution.

Eight important security updates address issues in Microsoft Office, Windows TCP/IP, Windows Audio Service, .NET Framework, MS SharePoint Foundation, Remote Desktop Protocol, Internet Information Services (IIS), Active Directory Federation Services and remaining two moderate security updates address issues in IME (Japanese) and Kernel Mode Driver.

Microsoft addresses zero-day vulnerability in the Windows OLE (CVE-2014-6352). Attackers have been exploiting this vulnerability to execute arbitrary code by tricking victims to open specially crafted PowerPoint files. To address this Microsoft had previously released security advisory KB3010060 and offered a work-around using EMET and a temporary patch in the form of a FixIt.

Microsoft security bulletin summary for November 2014 in order of severity.

MS14-064: Vulnerabilities in Windows OLE Could Allow Remote Code Execution (3011443)

Severity Rating: Critical

Affected Software: Windows OLE

Impact: Remote Code Execution

MS14-065: Cumulative Security Update for Internet Explorer (3003057)

Severity Rating: Critical

Affected Software: Internet Explorer

Impact: Remote Code Execution

MS14-066: Vulnerability in Schannel Could Allow Remote Code Execution (2992611)

Severity Rating: Critical

Affected Software: Windows Schannel

Impact: Remote Code Execution

MS14-067: Vulnerability in XML Core Services Could Allow Remote Code Execution (2993958)

Severity Rating: Critical

Affected Software: MSXML Core Services

Impact: Remote Code Execution

MS14-069: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3009710)

Severity Rating: Important

Affected Software: Microsoft Office

Impact: Remote Code Execution

MS14-070: Vulnerability in TCP/IP Could Allow Elevation of Privilege (2989935)

Severity Rating: Important

Affected Software: Microsoft Windows

Impact: Elevation of Privilege

MS14-071: Vulnerability in Windows Audio Service Could Allow Elevation of Privilege (3005607)

Severity Rating: Important

Affected Software: Microsoft Windows Audio

Impact: Elevation of Privilege

MS14-072: Vulnerability in .NET Framework Could Allow Elevation of Privilege (3005210)

Severity Rating: Important

Affected Software: .NET Framework

Impact: Elevation of Privilege

MS14-073: Vulnerability in Microsoft SharePoint Foundation Could Allow Elevation of Privilege (3000431)

Severity Rating: Important

Affected Software: Microsoft SharePoint Foundation

Impact: Elevation of Privilege

MS14-074: Vulnerability in Remote Desktop Protocol Could Allow Security Feature Bypass (3003743)

Severity Rating: Important

Affected Software: Remote Desktop

Impact: Security Feature Bypass

MS14-076: Vulnerability in Internet Information Services (IIS) Could Allow Security Feature Bypass (2982998)

Severity Rating: Important

Affected Software: MS Internet Information Services (IIS)

Impact: Security Feature Bypass

MS14-077: Vulnerability in Active Directory Federation Services Could Allow Information Disclosure (3003381)

Severity Rating: Important

Affected Software: Active Directory Federation Services

Impact: Information Disclosure

MS14-078: Vulnerability in IME (Japanese) Could Allow Elevation of Privilege (2992719)

Severity Rating: Moderate

Affected Software: Windows IME (Japanese)

Impact: Elevation of Privilege

MS14-079: Vulnerability in Kernel-Mode Driver Could Allow Denial of Service (3002885)

Severity Rating: Moderate

Affected Software: Windows Kernel-Mode Driver

Impact: Denial of Service

SecPod Saner detects these vulnerabilities and automatically fixes by applying security updates. Download Saner now and keep your systems updated and secure.

– Veerendra GG