CVE-2014-4114Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability

Descripción

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a "Sandworm" attack in June through October 2014, aka "Windows OLE Remote Code Execution Vulnerability."

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx Broken LinkVendor Advisory
• http://www.isightpartners.com/2014/10/cve-2014-4114/ Broken Link
• 60972 third-party-advisoryBroken Link
• 35055 exploitExploitThird Party AdvisoryVDB Entry
• 35019 exploitExploitThird Party AdvisoryVDB Entry
• 35020 exploitExploitThird Party AdvisoryVDB Entry
• 70419 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
• http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-windows-zero-day-vulnerability-cve-… Exploit
• MS14-060 vendor-advisoryPatchVendor Advisory
• 113140 vdb-entryBroken Link
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-4114 US Government Resource