Stories
Slash Boxes
Comments

SoylentNews is people

It's Nearly 2015 and Your Windows PC Can Still be Pwned by a Visual Basic Script

posted by LaminatorX on Thursday December 11 2014, @10:47PM   Printer-friendly
from the patchwork-guilt dept.

"gewg_" writes:

El Reg reports

Microsoft has patched 25 software vulnerabilities--including bugs that allow hackers to hijack PCs via Internet Explorer, Word and Excel files, and Visual Basic scripts.

Microsoft said its December's edition of Patch Tuesday includes critical fixes for Windows, Office and Internet Explorer as well as a patch for Exchange.

MS14-80: Addresses 14 security flaws in Internet Explorer, including various remote-code execution vulnerabilities and an ASLR bypass. The patch is considered a low risk for Windows Server systems, but critical for desktops, laptops and tablets. All the flaws were privately reported, and credit was given to various independent researchers as well as the HP Zero Day Initiative, Qihoo 360 and VeriSign iDefense Labs.

MS14-81: Two vulnerabilities in Word and Office Web Apps that allow an attacker to remotely execute code on targeted systems if the victims open booby-trapped documents. This update also applies to users running Office for Mac. Credit was given to Google Project Zero researcher Ben Hawkes, who privately reported the flaws to Microsoft. Rated as Critical.

MS14-84: A remote-code execution vulnerability (CVE-2014-6363) in the Windows VBScript engine can be exploited via a specially crafted webpage. Credit for discovery was given to SkyLined and VeriSign iDefense Labs. Rated as Critical.

The article also mentions Adobe software and Linux. Are any Soylentils running that combination?

 
This discussion has been archived. No new comments can be posted.
It's Nearly 2015 and Your Windows PC Can Still be Pwned by a Visual Basic Script | Log In/Create an Account | Top | 37 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 2) by mcgrew on Friday December 12 2014, @03:03PM

    by mcgrew (701) <publish@mcgrewbooks.com> on Friday December 12 2014, @03:03PM (#125470) Homepage Journal

    If you are still running with no protection and allow scripts from just anywhere to run? Then you sir or madam are an idiot

    Only if they've been informed, otherwise they're simply ignorant.

    The exact same thing an be done on Linux with the how to write a Linux virus in 5 easy steps showing a perfect example. Trick user with social engineering, run scripts without any sort of protection, get pwned.

    A trojan is not a virus. Your "write a Linux virus" is an ignorant headline.

    I googled for your KDE-look bug; no dice. Got a link?

    there is simply no way to make ANY OS 100% moron proof

    That is indeed correct. Now if we could make software houses idiot-free...

    --
    Carbon, The only element in the known universe to ever gain sentience
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  
    Total Score:   2