Operating System:

[Win]

Published:

04 November 2014

Protect yourself against future threats.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                              ESB-2014.1907.2
     Vulnerability in Microsoft OLE Could Allow Remote Code Execution
                              4 November 2014

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Microsoft Windows
Publisher:         Microsoft
Operating System:  Windows
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
Resolution:        Mitigation
CVE Names:         CVE-2014-6532  

Reference:         ASB-2014.0121

Original Bulletin: 
   https://technet.microsoft.com/library/security/3010060

Comment: Microsoft has released a one click "fix-it". A full patch has yet to
         be released at the time of this update.

Revision History:  November  4 2014: Changed the resolution to Mitigation
                   October  22 2014: Initial Release

- --------------------------BEGIN INCLUDED TEXT--------------------

Microsoft Security Advisory 3010060

Vulnerability in Microsoft OLE Could Allow Remote Code Execution

Published: October 21, 2014

Version: 1.0

General Information

Executive Summary

Microsoft is aware of a vulnerability affecting all supported releases of 
Microsoft Windows, excluding Windows Server 2003. The vulnerability could 
allow remote code execution if a user opens a specially crafted Microsoft 
Office file that contains an OLE object. An attacker who successfully 
exploited the vulnerability could gain the same user rights as the current 
user. Customers whose accounts are configured to have fewer user rights on 
the system could be less impacted than those who operate with administrative 
user rights. The attack requires user interaction to succeed on Windows 
clients with a default configuration, as User Account Control (UAC) is 
enabled and a consent prompt is displayed.

At this time, we are aware of limited, targeted attacks that attempt to 
exploit the vulnerability through Microsoft PowerPoint.

See the Suggested Actions section of this advisory for more information.

We are actively working with partners in our Microsoft Active Protections 
Program (MAPP) to provide information that they can use to provide broader 
protections to customers. For information about protections released by MAPP 
partners, see MAPP Partners with Updated Protections.

Upon completion of this investigation, Microsoft will take the appropriate 
action to help protect our customers. This may include providing a security 
update through our monthly release process or providing an out-of-cycle 
security update, depending on customer needs.

Mitigating Factors:

* In observed attacks, User Account Control (UAC) displays a consent prompt 
or an elevation prompt, depending on the privileges of the current user, 
before a file containing the exploit is executed. UAC is enabled by default 
on Windows Vista and newer releases of Microsoft Windows.

* An attacker who successfully exploited this vulnerability could gain the 
same user rights as the current user. Customers whose accounts are configured 
to have fewer user rights on the system could be less impacted than those who 
operate with administrative user rights.

* In a web-based attack scenario, an attacker could host a website that 
contains a webpage that contains a specially crafted Office file that is used 
to attempt to exploit this vulnerability. In all cases, however, an attacker 
would have no way to force users to visit these websites. Instead, an 
attacker would have to convince users to visit the website, typically by 
getting them to click a link in an email message or Instant Messenger message 
that takes users to the attacker's website.

* Files from the Internet and from other potentially unsafe locations can 
contain viruses, worms, or other kinds of malware that can harm your 
computer. To help protect your computer, files from these potentially unsafe 
locations are opened in Protected View. By using Protected View, you can read 
a file and see its contents while reducing the risks. Protected View is 
enabled by default.

Recommendation.  Please see the Suggested Actions section of this advisory 
for more information.

Advisory Details

Issue References

For more information about this issue, see the following references:

References                              Identification

Microsoft Knowledge Base Article        3010060
CVE Reference                           CVE-2014-6352

Affected Software

Operating System

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

Windows 8 for 32-bit Systems

Windows 8 for x64-based Systems

Windows 8.1 for 32-bit Systems

Windows 8.1 for x64-based Systems

Windows Server 2012

Windows Server 2012 R2

Windows RT

Windows RT 8.1
 
Advisory FAQ

What is the scope of the advisory? 

Microsoft is investigating reports of a vulnerability in affected releases of 
Microsoft Windows.

Is this a security vulnerability that requires Microsoft to issue a security 
update? 
On completion of our investigation, Microsoft will take the appropriate 
action to protect our customers, which may include providing a solution 
through our monthly security update release process, or an out-of-cycle 
security update, depending on customer needs.

What is OLE?

OLE (Object Linking and Embedding) is a technology that allows applications 
to share data and functionality, such as the ability to create and edit 
compound data. Compound data is data that contains information in multiple 
formats. For example, a compound Microsoft Word document may contain an 
embedded Microsoft Excel spreadsheet (or OLE object). This technology also 
enables in-place editing; instead of launching a new application when an OLE 
object is activated, the user instead sees a new set of menu items inside 
their existing application. For more information about OLE, see Compound 
Documents.

What is the difference between Microsoft PowerPoint Presentation and 
PowerPoint Show files? 
Microsoft PowerPoint Presentation files (.PPTX or .PPT file extensions) 
commonly open in edit mode. Microsoft PowerPoint Show files (.PPSX or .PPS 
file extensions) commonly open in presentation mode. PowerPoint Show files 
may be shared with users who do not intend to edit the file.

What might an attacker use the vulnerability to do? 

An attacker who successfully exploited this vulnerability could gain the same 
user rights as the current user. If the current user is logged on with 
administrative user rights, an attacker who successfully exploited this 
vulnerability could take complete control of an affected system. An attacker 
could then install programs; view, change, or delete data; or create new 
accounts with full user rights.

How could an attacker exploit the vulnerability? 

User interaction is required to exploit this vulnerability.

In an email attack scenario, an attacker could exploit the vulnerability by 
sending a specially-crafted file to the user. For this attack scenario to be 
successful, the user must be convinced to open the specially crafted file 
containing the malicious OLE object. All Microsoft Office file types as well 
as many other third-party file types could contain a malicious OLE object.

In a web-based attack scenario, an attacker would have to host a website that 
contains a specially crafted Microsoft Office file, such as a PowerPoint 
file, that is used in an attempt to exploit this vulnerability. In addition, 
compromised websites (and websites that accept or host user-provided content) 
could contain specially crafted content that could exploit this 
vulnerability. An attacker would have no method to force users to visit a 
malicious website. Instead, an attacker would have to persuade the targeted 
user to visit the website, typically by getting them to click a hyperlink 
that directs a web browser to the attacker-controlled website.

What is User Account Control? 

User Account Control (UAC) is a Windows security component that allows an 
administrator to enter credentials during a non-administrative user session 
to perform occasional administrative tasks.

What systems are primarily at risk from the vulnerability? 

Servers or workstations that open documents with embedded OLE objects are 
primarily at risk.

Suggested Actions

Apply Workarounds

Workarounds refer to a setting or configuration change that does not correct 
the underlying issue but would help block known attack vectors before a 
security update is available. 

Workarounds

* Apply the Microsoft Fix it solution, "OLE packager Shim Workaround", that 
prevents exploitation of the vulnerability
See Microsoft Knowledge Base Article 3010060 to use the automated Microsoft 
Fix it solution to enable or disable this workaround. 
     
Note:

The Fix it solution is available for Microsoft PowerPoint on 32-bit and 
x64-based editions of Microsoft Windows, with the exception of 64-bit 
editions of PowerPoint on x64-based editions of Windows 8 and Windows 8.1. 

* Do not open Microsoft PowerPoint files, or other files, from untrusted 
sources
Do not open Microsoft PowerPoint files that you receive from untrusted 
sources or that you receive unexpectedly from trusted sources. This 
vulnerability could be exploited when a user opens a specially crafted file. 

* Enable User Account Control (UAC)
Note User Account Control is enabled by default.
   1. Do one of the following to open Control Panel:
         a. Click Start, and then click Control Panel.
         b. Press the Windows logo key + s, type Control Panel, then open the 
         Control Panel app.

   2. In Control Panel, click User Accounts (or User Accounts and Family 
   Safety).

   3. In the User Accounts window, click User Accounts.

   4. In the User Accounts tasks window, click Turn User Account Control on 
   or off (or Change User Account Control settings).

   5. If UAC is currently configured in Admin Approval Mode, a UAC message 
   appears; click Continue.

   6. Click the check box "Use User Account Control (UAC) to help protect 
   your computer", and then click OK.

   7. Do one of the following:
         a. Click Restart Now to apply the change right away.
         b. Click Restart Later.

   8. Close the User Accounts tasks window. 

* Deploy the Enhanced Mitigation Experience Toolkit 5.0 and configure Attack 
Surface Reduction
The Attack Surface Reduction feature in EMET 5.0 can help block current 
attacks. You need to add configuration to the standard one in order to be 
protected. 

   1. Create a new file with the content below:

        <EMET Version="5.0.5324.31801">
          <Settings />
          <EMET_Apps>
            <AppConfig Path="*" Executable="dllhost.exe">
              <Mitigation Name="DEP" Enabled="false" />
              <Mitigation Name="SEHOP" Enabled="false" />
              <Mitigation Name="NullPage" Enabled="false" />
              <Mitigation Name="HeapSpray" Enabled="false" />
              <Mitigation Name="EAF" Enabled="false" />
              <Mitigation Name="EAF+" Enabled="false" />
              <Mitigation Name="MandatoryASLR" Enabled="false" />
              <Mitigation Name="BottomUpASLR" Enabled="false" />
              <Mitigation Name="LoadLib" Enabled="false" />
              <Mitigation Name="MemProt" Enabled="false" />
              <Mitigation Name="Caller" Enabled="false" />
              <Mitigation Name="SimExecFlow" Enabled="false" />
              <Mitigation Name="StackPivot" Enabled="false" />
              <Mitigation Name="ASR" Enabled="true">
                <asr_modules>packager.dll</asr_modules>
              </Mitigation>
            </AppConfig>
            <AppConfig Path="*\OFFICE1*" Executable="POWERPNT.EXE">
              <Mitigation Name="DEP" Enabled="true" />
              <Mitigation Name="SEHOP" Enabled="true" />
              <Mitigation Name="NullPage" Enabled="true" />
              <Mitigation Name="HeapSpray" Enabled="true" />
              <Mitigation Name="EAF" Enabled="true" />
              <Mitigation Name="EAF+" Enabled="false" />
              <Mitigation Name="MandatoryASLR" Enabled="true" />
              <Mitigation Name="BottomUpASLR" Enabled="true" />
              <Mitigation Name="LoadLib" Enabled="true" />
              <Mitigation Name="MemProt" Enabled="true" />
              <Mitigation Name="Caller" Enabled="true" />
              <Mitigation Name="SimExecFlow" Enabled="true" />
              <Mitigation Name="StackPivot" Enabled="true" />
              <Mitigation Name="ASR" Enabled="true">
                <asr_modules>flash*.ocx;packager.dll</asr_modules>
              </Mitigation>
            </AppConfig>
          </EMET_Apps>
        </EMET>

   2. Save this file as EMET_CVE-2014-6352.xml.

   3. From the EMET user interface, click Import from the File ribbon.

   4. Select the EMET_CVE-2014-6352.xml file and click Open.

   5. Alternatively, run this command from a Command Prompt with elevated 
   privileges to import the saved script "EMET_CVE-2014-6532.xml" into EMET:

        EMET_Conf.exe  --import EMET_CVE-2014-6352.xml
         

Additional Suggested Actions

* Protect your PC

We continue to encourage customers to follow our Protect Your Computer 
guidance of enabling a firewall, getting software updates and installing 
antivirus software. For more information, see Microsoft Safety & Security 
Center.

* Keep Microsoft Software Updated

Users running Microsoft software should apply the latest Microsoft security 
updates to help make sure that their computers are as protected as possible. 
If you are not sure whether your software is up to date, visit Microsoft 
Update, scan your computer for available updates, and install any 
high-priority updates that are offered to you. If you have automatic updating 
enabled and configured to provide updates for Microsoft products, the updates 
are delivered to you when they are released, but you should verify that they 
are installed.

Acknowledgments

Microsoft thanks the following for working with us to help protect customers:

* Drew Hintz, Shane Huntley, and Matty Pellegrino of the Google Security Team
* Haifei Li and Bing Sun of the McAfee Security Team

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVFgP8hLndAQH1ShLAQLWzA//ep3bOpN09H+eVgnCWGMpUwTS872pWXvI
5ksGE6MPTj0ve0LouBU9kDl3tO3A7cq4J4yZvuOoDT2NZs5Yv8xiLYBwVCZbWyD7
NmLsh7OXrxzFiOYTt5NR1Q0BP5mecdVVBvL9GhiQQcYr0dqmoe3DxEh97T78nE9T
Qn9nmDcUmhfim5/yi8wmCoy0uMRyZF2x9Mjp6G50NniOL6NDIEVyOExuo9bZu2VC
Uepf6QqbWrEVIfJjRivANikoBGfyYfUBMW1ommbLG4zHYvsfWZMTTC9VZUmtFzQv
kjDshfd5Tt+Rx0qa7BO8i4386nlBM1cu/bVc4sDz5sUEvXVzv4inYWW6UWVkTkyv
aHIOw7cLhzRUOuavzgTR4p+Lkp6GNZhUI8HudTzxDAgPc7XngLaXC7JuP6RA9ltI
vr0Xqtu6GXSDNZ47FdGemv9SdExKbVP7v3GNnw7lnQ3NDYYAprvyAX8bHCrMhp5A
Qo0l+TFS3/LH3HQAXWbo9w9V0JS1XCIVj3pabQDAS6JRt6OQl0DzpO6s/cYWo3uq
1ud5kDmp9o1G0Z4IJhollvnzuNQMRy1e3QKSW0f5pYDk0ANtcnaM5NGryNBtai0M
OvIc1cQLL6NzPJ/ubuZRw9v07tcac7KY6ali40dx/3gYbIlwKayQYQgnNRGjpHme
qP7E+LtbBzM=
=8d9R
-----END PGP SIGNATURE-----