Severity: : High
  Advisory Date: 11 de lutego de 2014

  DESCRIPTION

Microsoft addresses the following vulnerabilities in its February batch of patches:

  • (MS14-005) Vulnerability in Microsoft XML Core Services Could Allow Information Disclosure (2916036)
    Risk Rating: Important

    This security update resolves a publicly disclosed vulnerability in Microsoft XML Core Services included in Microsoft Windows. The vulnerability could allow information disclosure if a user views a specially crafted webpage using Internet Explorer.


  • (MS14-006) Vulnerability in IPv6 Could Allow Denial of Service (2904659)
    Risk Rating: Important

    This security update resolves a publicly disclosed vulnerability in Microsoft Windows. The vulnerability could allow denial of service if an attacker sends a large number of specially crafted IPv6 packets to an affected system.

  • (MS14-007) Vulnerability in Direct2D Could Allow Remote Code Execution (2912390)
    Risk Rating: Critical

    This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user views a specially crafted webpage using Internet Explorer.


  • (MS14-008) Vulnerability in Microsoft Forefront Protection for Exchange Could Allow Remote Code Execution (2927022)
    Risk Rating: Critical

    This security update resolves a privately reported vulnerability in Microsoft Forefront. The vulnerability could allow remote code execution if a specially crafted email message is scanned.


  • (MS14-009) Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (2916607)
    Risk Rating: Important

    This security update resolves two publicly disclosed vulnerabilities and one privately reported vulnerability in Microsoft .NET Framework. The most severe vulnerability could allow elevation of privilege if a user visits a specially crafted website or a website containing specially crafted web content.


  • (MS14-010) Cumulative Security Update for Internet Explorer (2909921)
    Risk Rating: Critical

    This security update resolves one publicly disclosed vulnerability and twenty-three privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer.


  • (MS14-011) Vulnerability in VBScript Scripting Engine Could Allow Remote Code Execution (2928390)
    Risk Rating: Critical

    This security update resolves a privately reported vulnerability in the VBScript scripting engine in Microsoft Windows. The vulnerability could allow remote code execution if a user visited a specially crafted website.


  INFORMATION EXPOSURE

Trend Micro Deep Security shields networks through the following Deep Packet Inspection (DPI) rules. Trend Micro customers using the Vulnerability Protection product or OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities.

MS Bulletin ID Vulnerability ID DPI Rule Number DPI Rule Name Release Date Vulnerability and IDF Compatibility
MS14-005 CVE-2014-0266 1005887 Microsoft XML Core Services Information Disclosure Vulnerability (CVE-2014-0266) 11-Feb-14 YES
MS14-007 CVE-2014-0263 1005888 Microsoft Graphics Component Memory Corruption Vulnerability (CVE-2014-0263) 11-Feb-14 YES
MS14-009 CVE-2014-0253 1005471 Identified Suspicious Low HTTP Server Bandwidth 23-Apr-13 NO
MS14-010 CVE-2014-0267 1005894 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0267) 11-Feb-14 YES
MS14-010 CVE-2014-0269 1005895 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0269) 11-Feb-14 YES
MS14-010 CVE-2014-0270 1005892 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0270) 11-Feb-14 YES
MS14-010 CVE-2014-0270 1005897 Internet Explorer Memory Corruption Vulnerability (CVE-2014-0270) 11-Feb-14 YES
MS14-010 CVE-2014-0271 1005872 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0271) 11-Feb-14 YES
MS14-010 CVE-2014-0272 1005893 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0272) 11-Feb-14 YES
MS14-010 CVE-2014-0273 1005878 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0273) 11-Feb-14 YES
MS14-010 CVE-2014-0274 1005881 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0274) 11-Feb-14 YES
MS14-010 CVE-2014-0275 1005883 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0275) 11-Feb-14 YES
MS14-010 CVE-2014-0276 1005884 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0276) 11-Feb-14 YES
MS14-010 CVE-2014-0277 1005869 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0277) 11-Feb-14 YES
MS14-010 CVE-2014-0278 1005870 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0278) 11-Feb-14 YES
MS14-010 CVE-2014-0279 1005873 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0279) 11-Feb-14 YES
MS14-010 CVE-2014-0281 1005874 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0281) 11-Feb-14 YES
MS14-010 CVE-2014-0283 1005885 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0283) 11-Feb-14 YES
MS14-010 CVE-2014-0284 1005886 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0284) 11-Feb-14 YES
MS14-010 CVE-2014-0285 1005876 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0285) 11-Feb-14 YES
MS14-010 CVE-2014-0286 1005877 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0286) 11-Feb-14 YES
MS14-010 CVE-2014-0287 1005871 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0287) 11-Feb-14 YES
MS14-010 CVE-2014-0288 1005879 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0288) 11-Feb-14 YES
MS14-010 CVE-2014-0289 1005880 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0289) 11-Feb-14 YES
MS14-010 CVE-2014-0290 1005882 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0290) 11-Feb-14 YES
MS14-010 CVE-2014-0271 1005872 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0271) 11-Feb-14 YES

  SOLUTION