KLA10605 Code execution vulnerability in Microsoft VBScript

An unspecified vulnerabilities were found in Microsoft VBScript engine. By exploiting these vulnerabilities malicious users can execute arbitrary code. These vulnerabilities can be exploited remotely via a specially designed web site.

Original advisories

CVE-2014-6363

CVE-2014-0271

Exploitation

Public exploits exist for this vulnerability.

Related products

Microsoft-VBScript-engine

CVE list

CVE-2014-6363 critical

CVE-2014-0271 critical

KB list

3012168

3008923

2909921

3012176

3012172

2909213

2909212

2909210

3016711

2928390

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• RLF

Read Local Files. Exploitation of vulnerabilities with this impact can lead to reading some inaccessible files. Files that can be read depends on conсrete program errors.

Affected Products

• Microsoft VBScript engine versions 5.6, 5.7, 5.8