Industry News

Microsoft Issues Nine Patches for 37 Bugs

Microsoft has issued nine patches for 37 issues in Windows, Office, SQL Server, Net Framework and SharePoint Server, according to the company’s August security bulletin.

The advisory patches fix severe vulnerabilities such as remote code execution, privilege escalation and security feature bypass.

“The most severe of these vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer,” the IE security update (MS14-051) said. “An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user.”

There are 26 patched Internet Explorer flaws in total, ranging from IE 6 to IE 11, as only one was disclosed and 25 others undisclosed.

Another remote code execution flaw was found in Windows Media Center that could allow an attacker to gain the same rights as the affected user.

Denial of Service Attack through IPv6 Router Advertisement Vulnerability

.NET Framework didn’t escape the patching this time, as a security bypass vulnerability was found and its details are undisclosed. An attacker could bypass the Address Space Layout Randomization (ASLR) via a specially crafted website.

“The security feature bypass by itself does not allow arbitrary code execution. However, an attacker could use this ASLR bypass vulnerability in conjunction with another vulnerability, such as a remote code execution vulnerability, that could take advantage of the ASLR bypass to run arbitrary code,” said the MS14-046 security bulletin.

The last critical vulnerabilities are privilege escalation flaws found in the Kernel-Mode Drivers. The exploit could allow an attacker to escalate privileges if he “logs on to the system and runs a specially crafted application.” This time the attacker “must have valid logon credentials and be able to log on locally” to exploit it.

Microsoft Windows users are advised to apply the latest update for their own security. These patched vulnerabilities are rated as severe and their exploitation could be damaging.

About the author

Lucian Ciolacu

Still the youngest Bitdefender News writer, Lucian is constantly after flash news in the security industry, especially when something is vulnerable or exploited. Besides digging for 'hacker' scoops and data leaks, he enjoys sports, such as football and tennis.
He has also combined an interest for social and political sciences, as a graduate of the Political Science Faculty, with a passion for guitar and computer games.