• Articles
    • Editorial Articles
    • Research Articles
    • WatchGuard Articles
  • The 443 Podcast
  • Threat Landscape
  • About
    • About Us
    • Contact Us
    • Contribute to Secplicity

Secplicity - Security Simplified

Powered by WatchGuard Technologies

Windows Updates Fix GDI+, RDP, and TCP Vulnerabilities

June 10, 2014 By Corey Nachreiner

Severity: High

Summary:

  • These vulnerabilities affect: All current versions of Windows (and related components like XML Core Services)
  • How an attacker exploits them: Multiple vectors of attack, including enticing you to malicious web sites, or into interacting with malicious documents or images.
  • Impact: In the worst case, an attacker can gain complete control of your Windows computer
  • What to do: Install the appropriate Microsoft patches as soon as possible, or let Windows Automatic Update do it for you

Exposure:

Today, Microsoft released four security bulletins describing five vulnerabilities in Windows and related components, such as XML Core Services. An attacker could exploit the worst of these flaws to potentially gain complete control of your Windows PC. We recommend you download, test, and deploy these critical updates as quickly as possible.

The summary below lists the vulnerabilities, in order from highest to lowest severity.

  • MS14-036: Two GDI+ Code Execution Vulnerabilities

The Graphics Device Interface (GDI+) is one of the Windows components that helps applications output graphics, to your display or printer. GDI+ suffers from two security flaws. Though they differ technically, the flaws share the same scope and impact, and have to do with how GDI+ handles specially crafted documents or images. If an attack can entice one of your users into viewing a malicious image or document, perhaps embedded in an email or web site, he can exploit either flaw to execute code on that user’s computer, with that user’s privileges. If your users have local administrative privileges, the attacker gains full control of their computer.

Microsoft rating: Critical

  • MS14-033:  MSXML Information Disclosure Vulnerability

Microsoft XML Core Services (MSXML)  is a component that helps Windows, Internet Explorer, and other Microsoft products handle XML content. It often ships with various versions of Windows, and other Microsoft products like Office, SharePoint Server, Groove Server, and Expressions. If you have a Windows computer, you very likely have MSXML.

According to today’s bulletin, MSXML suffers from an information disclosure vulnerability. If an attacker can entice one of your users to a specially crafted web site, or into opening a malicious document, she could invoke MSXML and leverage this flaw to obtain sensitive information from your user’s system. Specifically, the attacker can gain access to some local path information, and your user’s username.

Microsoft rating: Important

  • MS14-031:  TCP Protocol Denial of Service Flaw

As you would expect, the Windows TCP/IP stack is a set of networking protocols that allows your computer to get on the Internet and participate in modern networking. Unfortunately, the Windows TCP/IP stack suffers from an unspecified Denial of Server (DoS) vulnerability involving its inability to properly parse a specially crafted sequence of TCP packets. By sending a sequence of packets, an attacker could leverage this flaw to cause you computer to stop responding, causing a DoS situation. However, the attacker would have to initiate a large number of connections, and have control over the TCP options field of each packet.

Microsoft rating: Important

  • MS14-030:  RDP traffic tampering vulnerability

The Remote Desktop Protocol (RDP) is a Microsoft communication standard designed to allow you to gain access to your computers over a network to directly control your desktop. Unfortunately, the RDP component that ships with Windows doesn’t use very robust encryption by default. If an attacker can intercept your RDP traffic in a Man-in-the-Middle (MitM) attack, he could tamper with the RDP session in a way that allowed him to read session information or modify the RDP session. You can enable Network Level Authentication (NLA) to mitigate the risk of this flaw

Microsoft rating: Important

Solution Path:

Microsoft has released various updates that correct all of these vulnerabilities. You should download, test, and deploy the appropriate updates throughout your network immediately. If you choose, you can also let Windows Update automatically download and install them for you. As always, you should test your updates before deploying them.

The links below point directly to the “Affected and Non-Affected Software” section of each bulletin, where you can find links to the various updates:

  • MS14-030
  • MS14-031
  • MS14-033
  • MS14-036

For All WatchGuard Users:

Though WatchGuard’s XTM appliances offer defenses that can mitigate the risk of some of these flaws (such as blocking TCP traffic), attackers can exploit others locally. Since your gateway XTM appliance can’t protect you against local attacks, we recommend you install Microsoft’s updates to completely protect yourself from these flaws.

Status:

Microsoft has released patches correcting these issues.

References:

  • Microsoft Security Bulletin MS14-030
  • Microsoft Security Bulletin MS14-031
  • Microsoft Security Bulletin MS14-033
  • Microsoft Security Bulletin MS14-036

This alert was researched and written by Corey Nachreiner, CISSP (@SecAdept).


What did you think of this alert? Let us know at [email protected].

Share This:

Related

Filed Under: Security Bytes Tagged With: DoS, GDI+, Microsoft, RDP, Security Bulletins, Software vulnerabilities, TCP/IP, Updates and patches, XML Core Services

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

The 443 Podcast

A weekly podcast featuring the leading white-hat hackers and security researchers. Listen Now
the 443 podcast

Threat Landscape

Filter and view Firebox Feed data by type of attack, region, country, and date range. View Now
threat landscape

Top Posts

  • Cybersecurity News: Free Cybersecurity Training, TrickBot Group Exposed, Major GoDaddy Breach, and Russia to Legalize cybercrime?!
  • US National Cybersecurity Strategy
  • Here Come The Regulations
  • Cybersecurity’s Toll on Mental Health

Email Newsletter

Sign up to get the latest security news and threat analysis delivered straight to your inbox

By signing up you agree to our Privacy Policy.


The views and opinions expressed on this website are those of the authors and do not necessarily reflect the policy or position of WatchGuard Technologies.

Stay in Touch

Recent Posts

  • Cybersecurity News: LastPass Incident Revealed, White House Issues Cybersecurity Strategy, FBI Purchases Leaked USHOR PII Data, and a Slew of Other Breaches
  • An Update on Section 230
  • Here Come The Regulations
  • US National Cybersecurity Strategy
  • Cybersecurity News: Free Cybersecurity Training, TrickBot Group Exposed, Major GoDaddy Breach, and Russia to Legalize cybercrime?!
View All

Search

Archives

Copyright © 2023 WatchGuard Technologies · Cookie Policy · Privacy Policy · Terms of Use