{"id":113,"date":"2014-11-14T23:59:02","date_gmt":"2014-11-14T23:59:02","guid":{"rendered":"http:\/\/test.blueshell.im\/Blog\/?p=113"},"modified":"2020-08-16T08:45:25","modified_gmt":"2020-08-16T08:45:25","slug":"ta14-318b-microsoft-windows-ole-automation-array-remote-code-execution-vulnerability","status":"publish","type":"post","link":"http:\/\/www.blueshell.im\/Blog\/?p=113","title":{"rendered":"TA14-318B: Microsoft Windows OLE Automation Array Remote Code Execution Vulnerability"},"content":{"rendered":"<p class=\"\"><img loading=\"lazy\" class=\"\" src=\"https:\/\/public.govdelivery.com\/system\/images\/37745\/original\/BANNER_NCCIC_USC_01.png\" alt=\"NCCIC \/ US-CERT\" width=\"700\" height=\"100\"><\/p>\n<p class=\"\">National Cyber Awareness System:<\/p>\n<div class=\"rss_item\">\n<div class=\"rss_title\"><a class=\"\" href=\"https:\/\/www.us-cert.gov\/ncas\/alerts\/TA14-318A-0\">TA14-318B: Microsoft Windows OLE Automation Array Remote Code Execution Vulnerability<\/a><\/div>\n<div class=\"rss_pub_date\">11\/14\/2014 05:42 PM EST<\/div>\n<p><br class=\"\"><\/p>\n<div class=\"rss_description\">Original release date: November 14, 2014<br class=\"\"><\/p>\n<h3 class=\"\">Systems Affected<\/h3>\n<ul class=\"\">\n<li class=\"\">Microsoft Windows Vista, 7, 8, 8.1, RT, and RT 8.1<\/li>\n<li class=\"\">Microsoft Server 2003, Server 2008, Server 2008 R2, Server 2012, and Server 2012 R2<\/li>\n<\/ul>\n<h3 class=\"\">Overview<\/h3>\n<p class=\"\">A vulnerability in Microsoft Windows Object Linking and Embedding (OLE) could allow remote code execution if a user views a specially-crafted web page in Internet Explorer.<a class=\"\" href=\"https:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2014-6332\">[1]<\/a><\/p>\n<h3 class=\"\">Description<\/h3>\n<p class=\"\">The Microsoft Windows OLE OleAut32.dll library provides the SafeArrayRedim function that allows resizing of SAFEARRAY objects in memory.<a class=\"\" href=\"http:\/\/securityintelligence.com\/ibm-x-force-researcher-finds-significant-vulnerability-in-microsoft-windows\/\">[2]<\/a> In certain circumstances, this library does not properly check sizes of arrays when an error occurs. The improper size allows an attacker to manipulate memory in a way that can bypass the Internet Explorer Enhanced Protected Mode (EPM) sandbox as well as the Enhanced Mitigation Experience Toolkit (EMET).<\/p>\n<p class=\"\">This vulnerability can be exploited using a specially-crafted web page utilizing VBscript in Internet Explorer. However, it may impact other software that makes use of OleAut32.dll and VBscript.<\/p>\n<p class=\"\">Exploit code is publicly available for this vulnerability. Additional details may be found in CERT\/CC Vulnerability Note <a class=\"\" href=\"http:\/\/www.kb.cert.org\/vuls\/id\/158647\">VU#158647<\/a>.<\/p>\n<h3 class=\"\">Impact<\/h3>\n<p class=\"\">Arbitrary code can be run on the computer with user privileges. If the user is an administrator, the attacker may run arbitrary code as an administrator, fully compromising the system.<\/p>\n<h3 class=\"\">Solution<\/h3>\n<p class=\"\">An update is available from Microsoft.<a class=\"\" href=\"https:\/\/technet.microsoft.com\/library\/security\/MS14-064\">[3]<\/a> Please see Microsoft Security Bulletin MS14-064 for more details and mitigation guidance, and apply the necessary updates.<\/p>\n<h3 class=\"\">References<\/h3>\n<ul class=\"\">\n<li class=\"\"><a class=\"\" href=\"https:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2014-6332\">[1] NIST Vulnerability Summary for CVE-2014-6332<\/a><\/li>\n<li class=\"\"><a class=\"\" href=\"http:\/\/securityintelligence.com\/ibm-x-force-researcher-finds-significant-vulnerability-in-microsoft-windows\/\">[2] IBM X-Force Researcher Finds Significant Vulnerability in Microsoft Windows<\/a><\/li>\n<li class=\"\"><a class=\"\" href=\"https:\/\/technet.microsoft.com\/library\/security\/MS14-064\">[3] Microsoft Security Bulletin MS14-064 <\/a><\/li>\n<\/ul>\n<h3 class=\"\">Revision History<\/h3>\n<ul class=\"\">\n<li class=\"\">November 14, 2014: Initial Release<\/li>\n<\/ul>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>National Cyber Awareness System: TA14-318B: Microsoft Windows OLE Automation Array Remote Code Execution Vulnerability 11\/14\/2014 05:42 PM EST Original release date: November 14, 2014 Systems Affected Microsoft Windows Vista, 7, 8, 8.1, RT, and RT 8.1 Microsoft Server 2003, Server &hellip; <a href=\"http:\/\/www.blueshell.im\/Blog\/?p=113\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":47,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[4],"tags":[],"_links":{"self":[{"href":"http:\/\/www.blueshell.im\/Blog\/index.php?rest_route=\/wp\/v2\/posts\/113"}],"collection":[{"href":"http:\/\/www.blueshell.im\/Blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.blueshell.im\/Blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.blueshell.im\/Blog\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"http:\/\/www.blueshell.im\/Blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=113"}],"version-history":[{"count":2,"href":"http:\/\/www.blueshell.im\/Blog\/index.php?rest_route=\/wp\/v2\/posts\/113\/revisions"}],"predecessor-version":[{"id":525,"href":"http:\/\/www.blueshell.im\/Blog\/index.php?rest_route=\/wp\/v2\/posts\/113\/revisions\/525"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.blueshell.im\/Blog\/index.php?rest_route=\/wp\/v2\/media\/47"}],"wp:attachment":[{"href":"http:\/\/www.blueshell.im\/Blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=113"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.blueshell.im\/Blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=113"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.blueshell.im\/Blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=113"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}