Stories
Slash Boxes
Comments

SoylentNews is people

It's Nearly 2015 and Your Windows PC Can Still be Pwned by a Visual Basic Script

posted by LaminatorX on Thursday December 11 2014, @10:47PM   Printer-friendly
from the patchwork-guilt dept.

"gewg_" writes:

El Reg reports

Microsoft has patched 25 software vulnerabilities--including bugs that allow hackers to hijack PCs via Internet Explorer, Word and Excel files, and Visual Basic scripts.

Microsoft said its December's edition of Patch Tuesday includes critical fixes for Windows, Office and Internet Explorer as well as a patch for Exchange.

MS14-80: Addresses 14 security flaws in Internet Explorer, including various remote-code execution vulnerabilities and an ASLR bypass. The patch is considered a low risk for Windows Server systems, but critical for desktops, laptops and tablets. All the flaws were privately reported, and credit was given to various independent researchers as well as the HP Zero Day Initiative, Qihoo 360 and VeriSign iDefense Labs.

MS14-81: Two vulnerabilities in Word and Office Web Apps that allow an attacker to remotely execute code on targeted systems if the victims open booby-trapped documents. This update also applies to users running Office for Mac. Credit was given to Google Project Zero researcher Ben Hawkes, who privately reported the flaws to Microsoft. Rated as Critical.

MS14-84: A remote-code execution vulnerability (CVE-2014-6363) in the Windows VBScript engine can be exploited via a specially crafted webpage. Credit for discovery was given to SkyLined and VeriSign iDefense Labs. Rated as Critical.

The article also mentions Adobe software and Linux. Are any Soylentils running that combination?

 
This discussion has been archived. No new comments can be posted.
It's Nearly 2015 and Your Windows PC Can Still be Pwned by a Visual Basic Script | Log In/Create an Account | Top | 37 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 0) by Pino P on Friday December 12 2014, @03:02AM

    by Pino P (4721) on Friday December 12 2014, @03:02AM (#125364) Journal

    In a mechanism to implement an executable whitelist policy, how would you provide for something like Steam, which is designed for the installation of executable code?

  • (Score: 0) by Anonymous Coward on Friday December 12 2014, @08:51AM

    by Anonymous Coward on Friday December 12 2014, @08:51AM (#125410)

    From my reading of the parent post, your scenario is covered. He states 'If the object file or folder is not on a specified whitelist' meaning the object to be whitelisted may be a file or it may be a folder.

    If Steam is programmed to dump files in ever-changing parent directories on the system then that is a problem with Steam's design and not the parent poster's design.