=====================================================================

                           CERT-Renater

               Note d'Information No. 2014/VULN220
_____________________________________________________________________

DATE                : 15/10/2014

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows version Vista, Server 2008, 7, 8, 8.1,
                         Server 2012, RT running Windows OLE.

======================================================================
https://technet.microsoft.com/library/security/ms14-060
______________________________________________________________________

MS14-060 Vulnerability in Windows OLE Could Allow Remote Code Execution

Version: 1.0

Published Date: October 14, 2014

General Information

Executive Summary

This security update resolves a privately reported vulnerability in
Microsoft Windows. The vulnerability could allow remote code execution
if a user opens a Microsoft Office file that contains a specially
crafted OLE object. An attacker who successfully exploited this
vulnerability could run arbitrary code in the context of the current
user. If the current user is logged on with administrative user rights,
an attacker could then install programs; view, change, or delete data;
or create new accounts with full user rights.
Customers whose accounts are configured to have fewer user rights on
the system could be less impacted than users who operate with
administrative user rights.

This security update is rated Important for all supported releases of
Microsoft Windows.


Affected Software

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

Windows 8 for 32-bit Systems

Windows 8 for x64-based Systems

Windows 8.1 for 32-bit Systems

Windows 8.1 for x64-based Systems

Windows Server 2012

Windows Server 2012 R2

Windows RT

Windows RT 8.1


Windows OLE Remote Code Execution Vulnerability - CVE-2014-4114

A vulnerability exists in Windows OLE that could allow remote code
execution if a user opens a file that contains a specially crafted OLE
object. An attacker who successfully exploited this vulnerability could
gain the same user rights as the logged-on user. If the current user is
logged on with administrative user rights, an attacker could then
install programs; view, change, or delete data; or create new accounts
with full user rights.
Customers whose accounts are configured to have fewer user rights on
the system could be less impacted than users who operate with
administrative user rights.

To view this vulnerability as a standard entry in the Common
Vulnerabilities and Exposures list, see CVE-2014-4114.

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================