Microsoft Update Tuesday September 2014: another generally light month but with a significant IE bulletin
Summary: Microsoft's September 2014 Update Tuesday shipped four bulletins covering 42 CVEs, with the critical Internet Explorer bulletin MS14-052 accounting for 37 of them, 36 of which are remote code execution flaws. One IE flaw, CVE-2013-7331, is publicly known and under active exploitation, letting attackers use the XMLDOM ActiveX object to probe for local files, folders, and internal IP addresses via differing error messages.
Bottom line: One of the 42 CVEs is already public and being exploited in the wild, and it leaks exactly the kind of internal network detail - file presence and IP addresses - that attackers use to map a target before the next move.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2013-7331CVE-2014-4068CVE-2014-4070CVE-2014-4071CVE-2014-4072CVE-2014-4074
- Related
- CVE-2013-7331: Microsoft Internet Explorer Information Disclosure Vulnerability Known Exploited Vulnerabilities · May 25, 2022Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026