Is MS14-066 the Windows Shellshock?
The latest Patch Tuesday from Microsoft (November 11, 2014) includes fixes for some major vulnerabilities, including remote code execution bugs affecting core Windows components and Internet Explorer. The three major bulletins of note are MS14-064, MS14-065 and MS14-066, all of which have a CVSS score of above 9.0.
MS14-064 patches a bug in the Windows Object Linking and Embedding (OLE) library which appears to be a continuation of vulnerabilities disclosed last month in MS14-060 (aka Sandworm). Researchers have already seen this vulnerability used in the wild for exploitation through the use of malicious PowerPoint files. On the other hand, MS14-065 is a cumulative update that fixes 17 Internet Explorer bugs, including one major vulnerability that would enable an attacker to run code on a target system if the user was encouraged to view a crafted webpage using Internet Explorer.
This week is a good time to do a full credentialed scan
However, MS14-066 is more troublesome, since it’s a remote code execution vulnerability affecting all supported versions of Windows including the Server platforms. This bug was discovered in Schannel, a set of security protocols for communication and identity authentication. This vulnerability is of particular concern because an attacker could utilise it without user interaction. No proof of concept code has surfaced at this time, thanks to Microsoft being tight-lipped on the exact details of the vulnerability. But it won’t be long until proof of concept code does show up, which could be disastrous for any administrator who hasn’t updated Windows.
Is MS14-066, dubbed "WinShock," as bad as Shellshock and Heartbleed? At the moment, due to the lack of details and proof of concept code, it’s hard to say. But a remote code execution vulnerability affecting all versions of Windows Server on a common component like Schannel has the possibility of ranking right up there with the other major vulnerabilities of 2014.
As usual, with any “Bug Du Jour,” Tenable customers should use Nessus and SecurityCenter to identify hosts that are affected and patch accordingly. Plugins for both Nessus and SecurityCenter have been updated to detect if the patches for MS14-064, MS14-065 and MS14-066 are missing on affected hosts. The plugins also check for the 9 other updates released on Patch Tuesday 11/11/14.
This week is a good time to do a full credentialed scan of all the Windows and OS X assets on your network, since we’ve also seen major patches released by Adobe to address critical flaws in Flash and Air, and Google to fix critical vulnerabilities in Chrome.
Related Articles
Study: Tenable Offers Fastest, Broadest Coverage of CISA's KEV Catalog
October 23, 2023Tenable ranked first in multiple vulnerability management categories, including the most comprehensive coverage and quickest detection of CISA's Known Exploited Vulnerabilities, according to a Miercom report commissioned by Tenable.
Tuning Network Assessments for Performance and Resource Usage
September 13, 2022Using the correct tool for the job and optimizing scanner placement will have a large impact on scan efficiency with Nessus, Tenable.io and Tenable.sc.
Terrascan Joins the Nessus Community, Enabling Nessus To Validate Modern Cloud Infrastructures
May 17, 2022The addition of Terrascan to the Nessus family of products helps users better secure cloud native infrastructure by identifying misconfigurations, security weaknesses, and policy violations by scanning Infrastructure as Code repositories.
Cybersecurity Snapshot: Prompt Injection and Data Disclosure Top OWASP’s List of Cyber Risks for GenAI LLM Apps
November 22, 2024Don’t miss OWASP’s update to its “Top 10 Risks for LLMs” list. Plus, the ranking of the most harmful software weaknesses is out. Meanwhile, critical infrastructure orgs have a new framework for using AI securely. And get the latest on the BianLian ransomware gang and on the challenges of protecting water and transportation systems against cyberattacks.
Active Directory Under Attack: Five Eyes Guidance Targets Crucial Security Gaps
November 21, 2024A landmark global report from cybersecurity agencies emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the first of our two-part series, we offer five steps you can take today to shore up your AD defenses.
Five Cyber Agencies Sound Alarm About Active Directory Attacks: Beyond the Basics
November 21, 2024A landmark global report emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the second of our two-part series, we take you beyond the basics to highlight three key areas to focus on.
- Nessus
- Plugins
- SecurityCenter