=====================================================================

                           CERT-Renater

               Note d'Information No. 2014/VULN097
_____________________________________________________________________

DATE                : 10/04/2014

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Windows version XP, Server 2003, Vista,
                      Server 2008, 7, 8, Server 2012, RT, 8.1, RT 8.1.

======================================================================
KB2922229
http://technet.microsoft.com/en-us/security/bulletin/ms14-019
______________________________________________________________________

Microsoft Security Bulletin MS14-019 - Important Vulnerability in
Windows File Handling Component Could Allow Remote Code Execution
(2922229)

Published Date: April 8, 2014

Version: 1.0


General Information

Executive Summary

This security update resolves a publicly disclosed vulnerability in
Microsoft Windows. The vulnerability could allow remote code execution
if a user runs specially crafted .bat and .cmd files from a trusted or
semi-trusted network location. An attacker would have no way to force
users to visit the network location or run the specially crafted files.
Instead, an attacker would have to convince users to take such action.
For example, an attacker could trick users into clicking a link that
takes them to the location of the attacker's specially crafted files
and subsequently convince them to run them.

This security update is rated Important for all supported releases of
Windows.


Affected Software

Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
Windows 8 for 32-bit Systems
Windows 8 for x64-based Systems
Windows 8.1 for 32-bit Systems
Windows 8.1 for x64-based Systems
Windows Server 2012
Windows Server 2012 R2
Windows RT
Windows RT 8.1
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2012
Windows Server 2012 R2


Vulnerability Information

Windows File Handling Vulnerability - CVE-2014-0315

A remote code execution vulnerability exists in the way that Microsoft
Windows processes .bat and .cmd files that are run from an external
network. An attacker who successfully exploited this vulnerability
could take complete control of an affected system. An attacker could
then install programs; view, change, or delete data; or create new
accounts with full user rights. Users whose accounts are configured to
have fewer user rights on the system could be less impacted than users
who operate with administrative user rights.


=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================