Super Tuesday: A Patch Tuesday We Won’t Forget
Summary: In a single day Oracle released patches for 154 new vulnerabilities, Adobe updated Flash and ColdFusion, and Microsoft released 24 patches of its own, three of which addressed vulnerabilities under active exploitation in targeted attacks. The most serious, CVE-2014-4148, sits in the True Type Font subsystem of the win32k.sys kernel-mode driver and gives an attacker kernel-mode access that bypasses restrictions on non-administrative users, while CVE-2014-4114 in Windows OLE lets a PowerPoint Show file execute code with no user interaction and was used by the Sandworm campaign to deliver BlackEnergy malware.
Bottom line: The Sandworm group behind CVE-2014-4114 has been operating since at least 2009, and its BlackEnergy samples use encrypted HTTPS command and control, which evades IPS systems that are not decrypting traffic from unknown sites. CVE-2014-4148 was already used in a targeted attack against an international organization before most defenders had a signature.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2014-4113CVE-2014-4114CVE-2014-4148
- Related
- CVE-2014-4148: Microsoft Windows Remote Code Execution Vulnerability Known Exploited Vulnerabilities · May 25, 2022CVE-2014-4113: Microsoft Win32k Privilege Escalation Vulnerability Known Exploited Vulnerabilities · May 04, 2022