Microsoft

It's Microsoft Patch Tuesday: January 2014

Here's the information you need to make the right deploy decisions when applying Microsoft's January 2014 patches in your organization.
 
patch_tue.png
 After a busy December capping off a 2013 that saw an average of about nine security bulletins per month, Microsoft is kicking off 2014 with a lighter-than-usual Patch Tuesday. There are only four security bulletins this month, and all four are rated merely as Important.

The most notable of the bunch is MS14-002, because it addresses a zero day flaw in Windows XP that has already seen limited exploit in the wild for a few months. Don't let the lack of Critical bulletins make you apathetic, though -- you should still apply all applicable patches and updates as quickly as possible.

Security patches

1flag.gif
 MS14-001 / KB2916605 - Vulnerabilities in Microsoft Word and Office Web Apps Could Allow Remote Code Execution

This security bulletins addresses a few separate vulnerabilities in Microsoft Office. An attacker could use a specially-crafted malicious file to exploit the flaw and execute remote code on the vulnerable system. The impact of these flaws is reduced by the facts that the attacker first has to dupe a user into opening the malicious file, and that a successful exploit only allows the attacker to run remote code in the same context as the currently logged in user. As long as the user does not have Administrator privileges on the system, there is minimal risk.

3flags.png
 MS14-002 / KB2914368 - Vulnerability in Windows Kernel Could Allow Elevation of Privilege

This is the most crucial of the four security bulletins. The vulnerability affects Windows XP and Windows Server 2003. An attacker can gain elevated privileges on the target system by exploiting this flaw. One caveat is that the attacker must have valid logon credentials and be logged in locally on the system in order to execute a successful exploit. Attackers have been actively exploiting the vulnerability in the wild, though, so it is urgent that this patch be applied to vulnerable systems as soon as possible.

1flag2.gif
 MS14-003 / KB2913602 - Vulnerability in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege

This security bulletin addresses a vulnerability in the Windows kernel drivers in Windows 7 and Windows Server 2008 R2. Attackers can exploit this vulnerability to execute arbitrary code in the context of the kernel. Like MS14-002, Microsoft states that the attacker must have valid logon credentials and be logged in locally on the vulnerable system in order to initiate the exploit.

1flag3.gif
 MS14-004 / KB2880826 - Vulnerability in Microsoft Dynamics AX Could Allow Denial of Service

This security bulletin only affects customers running Microsoft Dynamics AX. An attacker can submit specially crafted data to a Microsoft Dynamics AX Application Object Server (AOS) instance to exploit the vulnerability and cause the a denial-of-service condition on the affected AOS instance. 
  

About

Tony Bradley is a principal analyst with Bradley Strategy Group. He is a respected authority on technology, and information security. He writes regularly for Forbes, and PCWorld, and contributes to a wide variety of online and print media outlets. He...

5 comments
d.l.todd
d.l.todd

I'm with J-R-Doe.  where's the link for the PDF?  I too keep a folder for later review and TechRepublic has been THE BEST source for the documentation that is manageable.  I miss the archives too.

J-R-Doe
J-R-Doe

Hi All,

I and I am sure that others are wondering where the link to the .PDF for this article is. 

I like to print from the .PDF and also keep a folder with the Microsoft Patch Tuesday docs for later use.


mldennis
mldennis

When will Windows ever be secure?  It seems when there are major releases, 7, 8, 2012...., there should be a big chance to make things right and secure.  The masses will not take this forever before moving on to an OS where there is not so much care and feeding.  At this point, Windows should have tools running all the time that is monitoring itself for holes and exploits.  When it finds one it should just stop working.

Gisabun
Gisabun

@mldennis Only 2 of the 4 updates are Windows OS related and they don't apply to all [the same two have been "trouble" though the past 6 months or so]. The vast majority of vulnerabilities are updated/corrected by Microsoft quite fast. Compare that against OS X where vulnerabilities were unfixed for months. [Apple has said that to fix 10.8 vulnerabilities, you must upgrade to 10.9.] Also remember that in 2011 Google's Chrome browser had more vulnerabilities than all Windows OS related vulnerabilities combined [reported by GFI, see their web site].

skrishna.santosh@yahoo.
skrishna.santosh@yahoo.

@mldennis All other operating systems (including Linux flavors) have lots of vulnerabilities... You should be happy that Microsoft is fixing them actively. Windows IS quite secure - I don't have an antivirus software - I never had them - and I follow one standard precaution that is common when working with Linux Boxes - ie., always login to standard user accounts for routine work..

Editor's Picks