Threat Level: green Handler on Duty: Jim Clausing

SANS ISC: InfoSec Handlers Diary Blog - Microsoft Patch Tuesday - August 2014 InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Microsoft Patch Tuesday - August 2014

Published: 2014-08-12
Last Updated: 2014-08-13 02:07:14 UTC
by Alex Stanford (Version: 1)
8 comment(s)

Overview of the August 2014 Microsoft patches and their status.

# Affected Contra Indications - KB Known Exploits Microsoft rating(**) ISC rating(*)
clients servers
MS14-043 Vulnerability in Windows Media Center Could Allow Remote Code Execution
Microsoft Windows

CVE-2014-4060
KB 2978742 No Severity:Critical
Exploitability: 1
Critical Important
MS14-044 Vulnerabilities in SQL Server Could Allow Elevation of Privilege
Microsoft SQL Server

CVE-2014-1820
CVE-2014-4061
KB 2984340 No Severity:Important
Exploitability: 1
Important Important
MS14-045 Vulnerabilities in Kernel-Mode Drivers Could Allow Elevation Of Privilege
Microsoft Windows

CVE-2014-0318
CVE-2014-1819
CVE-2014-4064
KB 2984615 No Severity:Important
Exploitability: 1
Important Important
MS14-046 Vulnerability in .NET Framework Could Allow Security Feature Bypass
Microsoft Windows,Microsoft .NET Framework

CVE-2014-4062
KB 2984625 No Severity:Important
Exploitability: 1
Important Important
MS14-047 Vulnerability in LRPC Could Allow Security Feature Bypass
Microsoft Windows

CVE-2014-0316
KB 2978668 No Severity:Important
Exploitability: 1
Important Important
MS14-048 Vulnerability in OneNote Could Allow Remote Code Execution
Microsoft Office

CVE-2014-2815
KB 2977201 No Severity:Important
Exploitability: 1
Critical Important
MS14-049 Vulnerability in Windows Installer Service Could Allow Elevation of Privilege
Microsoft Windows

CVE-2014-1814
KB 2962490 No Severity:Important
Exploitability: 1
Important Important
MS14-050 Vulnerability in Microsoft SharePoint Server Could Allow Elevation of Privilege
Microsoft Server Software

CVE-2014-2816
KB 2977202 No Severity:Important
Exploitability: 1
Important Important
MS14-051 Cumulative Security Update for Internet Explorer
Microsoft Windows, Internet Explorer

CVE-2014-2774 CVE-2014-2784 CVE-2014-2796 CVE-2014-2808 CVE-2014-2810 CVE-2014-2811 CVE-2014-2817 CVE-2014-2818 CVE-2014-2819 CVE-2014-2820 CVE-2014-2821 CVE-2014-2822 CVE-2014-2823 CVE-2014-2824 CVE-2014-2825 CVE-2014-2826 CVE-2014-2827 CVE-2014-4050 CVE-2014-4051 CVE-2014-4052 CVE-2014-4055 CVE-2014-4056 CVE-2014-4057 CVE-2014-4058 CVE-2014-4063 CVE-2014-4067 CVE-2014-2774 CVE-2014-2784 CVE-2014-2796 CVE-2014-2808 CVE-2014-2810 CVE-2014-2811 CVE-2014-2817 CVE-2014-2818 CVE-2014-2819 CVE-2014-2820 CVE-2014-2821 CVE-2014-2822 CVE-2014-2823 CVE-2014-2824 CVE-2014-2825 CVE-2014-2826 CVE-2014-2827 CVE-2014-4050 CVE-2014-4051 CVE-2014-4052 CVE-2014-4055 CVE-2014-4056 CVE-2014-4057 CVE-2014-4058 CVE-2014-4063 CVE-2014-4067
KB 2976627 Yes! Severity:Critical
Exploitability: 1
Critical Important
We will update issues on this page for about a week or so as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
(*): ISC rating
  • We use 4 levels:
    • PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
    • Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
    • Important: Things where more testing and other measures can help.
    • Less Urgent practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
    • The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threatatches.

--
Alex Stanford - GIAC GWEB & GIAC GSEC
Research Operations Manager,
SANS Internet Storm Center

Keywords: mspatchday
8 comment(s)
Diary Archives