Microsoft Patch Tuesday - August 2014

Published: 2014-08-12
Last Updated: 2014-08-13 02:07:14 UTC
by Alex Stanford (Version: 1)
8 comment(s)

Overview of the August 2014 Microsoft patches and their status.

# Affected Contra Indications - KB Known Exploits Microsoft rating(**) ISC rating(*)
clients servers
MS14-043 Vulnerability in Windows Media Center Could Allow Remote Code Execution
Microsoft Windows

CVE-2014-4060		 KB 2978742 No Severity:Critical
Exploitability: 1		 Critical Important
MS14-044 Vulnerabilities in SQL Server Could Allow Elevation of Privilege
Microsoft SQL Server

CVE-2014-1820
CVE-2014-4061		 KB 2984340 No Severity:Important
Exploitability: 1		 Important Important
MS14-045 Vulnerabilities in Kernel-Mode Drivers Could Allow Elevation Of Privilege
Microsoft Windows

CVE-2014-0318
CVE-2014-1819
CVE-2014-4064		 KB 2984615 No Severity:Important
Exploitability: 1		 Important Important
MS14-046 Vulnerability in .NET Framework Could Allow Security Feature Bypass
Microsoft Windows,Microsoft .NET Framework

CVE-2014-4062		 KB 2984625 No Severity:Important
Exploitability: 1		 Important Important
MS14-047 Vulnerability in LRPC Could Allow Security Feature Bypass
Microsoft Windows

CVE-2014-0316		 KB 2978668 No Severity:Important
Exploitability: 1		 Important Important
MS14-048 Vulnerability in OneNote Could Allow Remote Code Execution
Microsoft Office

CVE-2014-2815		 KB 2977201 No Severity:Important
Exploitability: 1		 Critical Important
MS14-049 Vulnerability in Windows Installer Service Could Allow Elevation of Privilege
Microsoft Windows

CVE-2014-1814		 KB 2962490 No Severity:Important
Exploitability: 1		 Important Important
MS14-050 Vulnerability in Microsoft SharePoint Server Could Allow Elevation of Privilege
Microsoft Server Software

CVE-2014-2816		 KB 2977202 No Severity:Important
Exploitability: 1		 Important Important
MS14-051 Cumulative Security Update for Internet Explorer
Microsoft Windows, Internet Explorer

CVE-2014-2774 CVE-2014-2784 CVE-2014-2796 CVE-2014-2808 CVE-2014-2810 CVE-2014-2811 CVE-2014-2817 CVE-2014-2818 CVE-2014-2819 CVE-2014-2820 CVE-2014-2821 CVE-2014-2822 CVE-2014-2823 CVE-2014-2824 CVE-2014-2825 CVE-2014-2826 CVE-2014-2827 CVE-2014-4050 CVE-2014-4051 CVE-2014-4052 CVE-2014-4055 CVE-2014-4056 CVE-2014-4057 CVE-2014-4058 CVE-2014-4063 CVE-2014-4067 CVE-2014-2774 CVE-2014-2784 CVE-2014-2796 CVE-2014-2808 CVE-2014-2810 CVE-2014-2811 CVE-2014-2817 CVE-2014-2818 CVE-2014-2819 CVE-2014-2820 CVE-2014-2821 CVE-2014-2822 CVE-2014-2823 CVE-2014-2824 CVE-2014-2825 CVE-2014-2826 CVE-2014-2827 CVE-2014-4050 CVE-2014-4051 CVE-2014-4052 CVE-2014-4055 CVE-2014-4056 CVE-2014-4057 CVE-2014-4058 CVE-2014-4063 CVE-2014-4067		 KB 2976627 Yes! Severity:Critical
Exploitability: 1		 Critical Important
We will update issues on this page for about a week or so as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
(*): ISC rating
  • We use 4 levels:
    • PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
    • Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
    • Important: Things where more testing and other measures can help.
    • Less Urgent practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
    • The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threatatches.

--
Alex Stanford - GIAC GWEB & GIAC GSEC
Research Operations Manager,
SANS Internet Storm Center

Keywords: mspatchday
8 comment(s)

Comments

I'm interested to know the logic behind MS14-043 being Critical for Servers, when Microsoft explicitly states that all Server OS' are unaffected.

Anonymous

Aug 12th 2014
8 years ago

We typically rate "server" and "client" vulnerabilities based on the use of the system, and not on the fact that the system runs a server or client designated OS. For example, you can run a web server on Windows 8, even though it may not be recommended.

In this particular case however, I reconsidered the rating and lowered it to "Important" for servers as servers typically do not use Windows Media Center.

Anonymous

Aug 13th 2014
8 years ago

I wonder why Windows 8.1 patch updates which fix a lot of their issues are labeled as "optional" by MS? I went through the ones this month and last month, and some of them are HUGE bugfixes, such as making things like Samba work, USB devices not somehow flake out, and many others...

Anonymous

Aug 13th 2014
8 years ago

'Appears to be some trouble with MS14-045 (some get BSOD's), 'not certain it has been nailed down yet.
- http://www.infoworld.com/t/microsoft-windows/blue-screen-stop-0x050-error-reported-systems-installing-kb2976897-kb2982791-and-kb2970228-248363
Aug 14, 2014
___

There is an MS thread (up to 7 pgs. last time I looked) here:
- http://answers.microsoft.com/en-us/windows/forum/windows_7-windows_update/blue-screen-stop-0x50-after-applying-update/6da4d264-02d8-458e-89e2-a78fe68766fd

.

Anonymous

Aug 14th 2014
8 years ago

New Features available from Microsoft when it comes to managing old ActiveX components.

Note old java versions will be blocked in IE from early September!

Download and deploy GPO now if you need to manage this..

http://support.microsoft.com/kb/2991000

Tor

Anonymous

Aug 15th 2014
8 years ago

MS14-045 - See "Known issues" ...
- https://support.microsoft.com/kb/2982791
Last Review: August 16, 2014 - Revision: 4.0 - "... Status:
Microsoft has -removed- the download links to these updates while these issues are being investigated...
Mitigations: Open the Programs and Features item in Control Panel, and then click View installed updates. Find and then -uninstall- any of the following update that are currently installed:
KB2982791
KB2970228
KB2975719
KB2975331 ..."
(More detail at the URL above.)
.

Anonymous

Aug 16th 2014
8 years ago

in addition to the 4 patches listed above, Microsoft released today rev. 2.0 of Support Article 2991509 to inform and offer a Hotfix for systems with cumulative Internet Explorer Updates applied that may become slow and unresponsive over time.
In case you or one of your users face these issues, the Support article contains the download links for corrective action.

For more information, see Microsoft Security Bulletin MS14-051. Security update 2976627 resolves one publicly disclosed and 25 privately reported vulnerabilities in Internet Explorer.
The most severe of these vulnerabilities could allow remote code execution if you view a specially crafted webpage by using Internet Explorer.
Additionally, this security update includes several non-security fixes and improvements for Internet Explorer.
Note Internet Explorer may crash after you install this security update. See the "Known issues and more information" section for more information.

After you apply the MS14-037 (KB2962872) or MS14-051 (KB2976627) cumulative security update for Internet Explorer, web applications that implement consecutive modal dialog boxes may cause Internet Explorer to become slow and unresponsive over time.
This issue occurs in Internet Explorer versions 7 through 11. To resolve this issue, Microsoft has released updates for Internet Explorer versions 7 through 11 not yet available on WSUS or usual Microsoft or Windows Update sites.
Before you install one of the updates, you must have MS14-051 Cumulative security update for Internet Explorer (KB2976627) installed to apply the Hotfix and must restart the computer after you apply it.

Anonymous

Aug 21st 2014
8 years ago

and see: http://support.microsoft.com/kb/2881011

Another issue has been discovered in the August 12, 2014, update for Microsoft Outlook 2013 that prevents some users from opening archived folders. Microsoft has removed this update from availability, and has corrected this issue in update KB2889859
(http://support.microsoft.com/kb/2889859/ ).

Anonymous

Aug 22nd 2014
8 years ago

Login here to join the discussion.


Top of page
Diary Archives