Advisories

CERT-In Advisory CIAD-2014-0067

Multiple Vulnerabilities in Microsoft Products

Original Issue Date: December 10, 2014

Software Affected

Windows Vista x64 Edition SP2
Windows Server 2003 and x64 Edition & Itanium-based Systems Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Server 2008 for 32-bit, x64-based & Itanium-based Systems SP2
Windows Server 2008 R2 for x64-based Systems SP1 and Itanium-based Systems SP1
Windows 7 for 32-bit and x64-based Systems SP1
Windows Server 2008 R2 for x64-based & Itanium-based Systems SP1
Windows 8 for 32-bit Systems and x64-based Systems
Windows 8.1 for 32-bit Systems and x64-based Systems
Windows Server 2012
Windows Server 2012 R2
Microsoft Office 2007 SP 3
Microsoft Office 2010 SP2 (32-bit editions and 64-bit editions)
Microsoft Office 2013 (32-bit editions and 64-bit editions)
Microsoft Office 2013 SP1 (32-bit editions and 64-bit editions)
Microsoft Office 2013 RT SP1
Microsoft Office Compatibility Pack SP 3
Microsoft Exchange Server 2007 & 2010 Service Pack 3
Microsoft Exchange Server 2013 Service Pack 1
Microsoft SharePoint Server 2010 & 2013
Microsoft Office Web Apps 2010 & 2013
Internet Explorer 6,7,8,9,10 & 11
VBScript 5.6
VBScript 5.7
VBScript 5.8

Overview

Multiple Vulnerabilities have been reported in various components of Microsoft Products.

Description

The vulnerability notes released by CERT-In with reference to Microsoft Security Bulletins are given below:

Microsoft Security Bulletin	Severity	CERT-In Vulnerability Notes
MS14-075:Vulnerabilities in Microsoft Exchange Server Could Allow Elevation of Privilege	Medium	CIVN-2014-0274 Multiple Vulnerabilities in Microsoft Exchange Server
MS14-080:Cumulative Security Update for Internet Explorer	High	CIVN-2014-0275 Multiple Vulnerabilities in Microsoft Internet Explorer
MS14-081:Vulnerabilities in Microsoft Word and Microsoft Office Web Apps Could Allow Remote Code Execution	Medium	CIVN-2014-0276 Microsoft Office Memory Corruption Vulnerabilities
MS14-082:Vulnerability in Microsoft Office Could Allow Remote Code Execution	High	CIVN-2014-0277 Remote Code Execution Vulnerability in Microsoft Office
MS14-083:Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution	Medium	CIVN-2014-0278 Multiple Remote Code Execution Vulnerabilities in Microsoft Excel
MS14-084:Vulnerability in VBScript Scripting Engine Could Allow Remote Code Execution	High	CIVN-2014-0279 Remote Code Execution Vulnerability in the VBScript Scripting Engine in Microsoft Internet Explorer
MS14-085:Vulnerability in Microsoft Graphics Component Could Allow Information Disclosure	High	CIVN-2014-0280 Microsoft Graphics Component Information Disclosure Vulnerability

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin December 2014
https://technet.microsoft.com/library/security/ms14-dec

Vendor Information

Microsoft Corporation
https://technet.microsoft.com/library/security/ms14-dec

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India