Microsoft Patch Tuesday - August 2014
Overview of the August 2014 Microsoft patches and their status.
| # | Affected | Contra Indications - KB | Known Exploits | Microsoft rating(**) | ISC rating(*) | |
|---|---|---|---|---|---|---|
| clients | servers | |||||
| MS14-043 | Vulnerability in Windows Media Center Could Allow Remote Code Execution | |||||
| Microsoft Windows CVE-2014-4060 |
KB 2978742 | No | Severity:Critical Exploitability: 1 |
Critical | Important | |
| MS14-044 | Vulnerabilities in SQL Server Could Allow Elevation of Privilege | |||||
| Microsoft SQL Server CVE-2014-1820 CVE-2014-4061 |
KB 2984340 | No | Severity:Important Exploitability: 1 |
Important | Important | |
| MS14-045 | Vulnerabilities in Kernel-Mode Drivers Could Allow Elevation Of Privilege | |||||
| Microsoft Windows CVE-2014-0318 CVE-2014-1819 CVE-2014-4064 |
KB 2984615 | No | Severity:Important Exploitability: 1 |
Important | Important | |
| MS14-046 | Vulnerability in .NET Framework Could Allow Security Feature Bypass | |||||
| Microsoft Windows,Microsoft .NET Framework CVE-2014-4062 |
KB 2984625 | No | Severity:Important Exploitability: 1 |
Important | Important | |
| MS14-047 | Vulnerability in LRPC Could Allow Security Feature Bypass | |||||
| Microsoft Windows CVE-2014-0316 |
KB 2978668 | No | Severity:Important Exploitability: 1 |
Important | Important | |
| MS14-048 | Vulnerability in OneNote Could Allow Remote Code Execution | |||||
| Microsoft Office CVE-2014-2815 |
KB 2977201 | No | Severity:Important Exploitability: 1 |
Critical | Important | |
| MS14-049 | Vulnerability in Windows Installer Service Could Allow Elevation of Privilege | |||||
| Microsoft Windows CVE-2014-1814 |
KB 2962490 | No | Severity:Important Exploitability: 1 |
Important | Important | |
| MS14-050 | Vulnerability in Microsoft SharePoint Server Could Allow Elevation of Privilege | |||||
| Microsoft Server Software CVE-2014-2816 |
KB 2977202 | No | Severity:Important Exploitability: 1 |
Important | Important | |
| MS14-051 | Cumulative Security Update for Internet Explorer | |||||
| Microsoft Windows, Internet Explorer CVE-2014-2774 CVE-2014-2784 CVE-2014-2796 CVE-2014-2808 CVE-2014-2810 CVE-2014-2811 CVE-2014-2817 CVE-2014-2818 CVE-2014-2819 CVE-2014-2820 CVE-2014-2821 CVE-2014-2822 CVE-2014-2823 CVE-2014-2824 CVE-2014-2825 CVE-2014-2826 CVE-2014-2827 CVE-2014-4050 CVE-2014-4051 CVE-2014-4052 CVE-2014-4055 CVE-2014-4056 CVE-2014-4057 CVE-2014-4058 CVE-2014-4063 CVE-2014-4067 CVE-2014-2774 CVE-2014-2784 CVE-2014-2796 CVE-2014-2808 CVE-2014-2810 CVE-2014-2811 CVE-2014-2817 CVE-2014-2818 CVE-2014-2819 CVE-2014-2820 CVE-2014-2821 CVE-2014-2822 CVE-2014-2823 CVE-2014-2824 CVE-2014-2825 CVE-2014-2826 CVE-2014-2827 CVE-2014-4050 CVE-2014-4051 CVE-2014-4052 CVE-2014-4055 CVE-2014-4056 CVE-2014-4057 CVE-2014-4058 CVE-2014-4063 CVE-2014-4067 |
KB 2976627 | Yes! | Severity:Critical Exploitability: 1 |
Critical | Important | |
We will update issues on this page for about a week or so as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
(*): ISC rating
- We use 4 levels:
- PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
- Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
- Important: Things where more testing and other measures can help.
- Less Urgent practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
- The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threatatches.
--
Alex Stanford - GIAC GWEB & GIAC GSEC
Research Operations Manager,
SANS Internet Storm Center
Keywords: mspatchday
8 comment(s)
Join us at SANS!
SANS SEC503: Intrusion Detection In-Depth. Gain the technical knowledge, insight, and hands-on training you need to defend your network with confidence.
