Stories
Slash Boxes
Comments

SoylentNews is people

It's Nearly 2015 and Your Windows PC Can Still be Pwned by a Visual Basic Script

posted by LaminatorX on Thursday December 11 2014, @10:47PM   Printer-friendly
from the patchwork-guilt dept.

"gewg_" writes:

El Reg reports

Microsoft has patched 25 software vulnerabilities--including bugs that allow hackers to hijack PCs via Internet Explorer, Word and Excel files, and Visual Basic scripts.

Microsoft said its December's edition of Patch Tuesday includes critical fixes for Windows, Office and Internet Explorer as well as a patch for Exchange.

MS14-80: Addresses 14 security flaws in Internet Explorer, including various remote-code execution vulnerabilities and an ASLR bypass. The patch is considered a low risk for Windows Server systems, but critical for desktops, laptops and tablets. All the flaws were privately reported, and credit was given to various independent researchers as well as the HP Zero Day Initiative, Qihoo 360 and VeriSign iDefense Labs.

MS14-81: Two vulnerabilities in Word and Office Web Apps that allow an attacker to remotely execute code on targeted systems if the victims open booby-trapped documents. This update also applies to users running Office for Mac. Credit was given to Google Project Zero researcher Ben Hawkes, who privately reported the flaws to Microsoft. Rated as Critical.

MS14-84: A remote-code execution vulnerability (CVE-2014-6363) in the Windows VBScript engine can be exploited via a specially crafted webpage. Credit for discovery was given to SkyLined and VeriSign iDefense Labs. Rated as Critical.

The article also mentions Adobe software and Linux. Are any Soylentils running that combination?

 
This discussion has been archived. No new comments can be posted.
It's Nearly 2015 and Your Windows PC Can Still be Pwned by a Visual Basic Script | Log In/Create an Account | Top | 37 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 3, Insightful) by rts008 on Friday December 12 2014, @05:51AM

    by rts008 (3001) on Friday December 12 2014, @05:51AM (#125385)

    If you are connected, you are vulnerable. Period.

    Hardware and software are currently too complex to fully 'cover your bases' for all use cases.

    Many well thought out plans seem perfect/ideal...until you introduce humans into the equation...then Demon Murphy(of Murphy's Law fame) rules the roost, and all goes to hell in a hand basket.

    There will always be an unexpected edge case that breaks the system enough to be exploited by observent persons.

    We humans have been 'gaming the system' for our benefit since before we had fire or 'civilisation', and computers/networks are different somehow?

    Starting Score:    1  point
    Moderation   +1  
       Insightful=1, Total=1
    Extra 'Insightful' Modifier   0  
    Karma-Bonus Modifier   +1  
    Total Score:   3  

  • (Score: 2) by WillR on Friday December 12 2014, @02:56PM

    by WillR (2012) on Friday December 12 2014, @02:56PM (#125468)
    And as Stuxnet taught the world, if you think you are not connected... you are probably still connected.