Cisco Applied Mitigation Bulletin-
Microsoft announced seven security bulletins that address 23 vulnerabilities as part of the monthly security bulletin release on December 9, 2014. A summary of these bulletins is on the Microsoft website at https://technet.microsoft.com/library/security/ms14-dec. This document provides identification and mitigation techniques that administrators can deploy on Cisco network devices.
The vulnerabilities that have a client software attack vector, can be exploited locally on the vulnerable device, require user interaction, or can be exploited using web-based attacks (these include but are not limited to cross-site scripting, phishing, and web-based email threats), or email attachments, are in the following list:
The vulnerability that has a network mitigation, including web and email security issues, are in the following list. Cisco devices provide several countermeasures for the vulnerability that has a network attack vector, which will be discussed in detail later in this document.
Information about affected and unaffected products is available in the respective Microsoft advisories and the Cisco Alerts that are referenced in Cisco Event Response: Microsoft Security Bulletin Release for December 2014.
In addition, multiple Cisco products use Microsoft operating systems as their base operating system. Cisco products that may be affected by the vulnerabilities described in the referenced Microsoft advisories are detailed in the "Associated Products" table in the "Product Sets" section.
-
MS14-080, Cumulative Security Update of Internet Explorer (3008923): These vulnerabilities have been assigned Common Vulnerabilities and Exposures (CVE) identifiers CVE-2014-6327, CVE-2014-6328, CVE-2014-6329, CVE-2014-6330, CVE-2014-6363, CVE-2014-6365, CVE-2014-6366, CVE-2014-6368, CVE-2014-6369, CVE-2014-6373, CVE-2014-6374, CVE-2014-6375, CVE-2014-6376, and CVE-2014-8966. These vulnerabilities can be exploited remotely without authentication and require user interaction. Successful exploitation of these vulnerabilities may allow arbitrary code execution. The attack vector for exploitation of these vulnerabilities is through HTTP and HTTPS packets that typically use TCP port 80 and port 443 but may also use TCP ports 3128, 8000, 8010, 8080, 8888, and 24326.
Cross-site scripting and phishing could also be used to exploit these vulnerabilities. For additional information about cross-site scripting attacks and the methods used to exploit these vulnerabilities, refer to the Cisco Applied Mitigation Bulletin Understanding Cross-Site Scripting (XSS) Threat Vectors.
-
Information about vulnerable, unaffected, and fixed software is available in the Microsoft Security Bulletin Summary for December 2014, which is available at the following link: https://technet.microsoft.com/library/security/ms14-dec
-
The vulnerabilities that have a client software attack vector, can be exploited locally on the vulnerable device, require user interaction, or can be exploited using web-based attacks (these include but are not limited to cross-site scripting, phishing, and web-based email threats), or email attachments, are in the following list:
These vulnerabilities are mitigated most successfully at the endpoint through software updates, user education, desktop administration best practices, and endpoint protection software such as Host Intrusion Prevention Systems (HIPS) or antivirus products.
The vulnerability that has a network mitigation, including web and email security issues, is in the following list. Cisco devices provide several countermeasures for this vulnerability. This section of the document provides an overview of these techniques.
Effective use of Cisco Intrusion Prevention System (IPS) event actions provides visibility into and protection against attacks that attempt to exploit these vulnerabilities.
Effective use of Sourcefire Intrusion Prevention System (IPS) event actions provides visibility into and protection against attacks that attempt to exploit these vulnerabilities.
-
Organizations are advised to follow their standard risk evaluation and mitigation processes to determine the potential impact of these vulnerabilities. Triage refers to sorting projects and prioritizing efforts that are most likely to be successful. Cisco has provided documents that can help organizations develop a risk-based triage capability for their information security teams. Risk Triage for Security Vulnerability Announcements and Risk Triage and Prototyping can help organizations develop repeatable security evaluation and response processes.
-
Caution: The effectiveness of any mitigation technique depends on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. As with any configuration change, evaluate the impact of this configuration prior to applying the change.
Specific information about mitigation and identification is available for these devices:
Cisco Intrusion Prevention System
Mitigation: Cisco IPS Signature Event Actions
Administrators can use the Cisco IPS appliances and services modules to provide threat detection and help prevent attempts to exploit several of the vulnerabilities described in this document. The following table provides an overview of CVE identifiers and the respective Cisco IPS signatures that will trigger events on potential attempts to exploit these vulnerabilities.
CVE ID Signature Release Signature ID Signature Name Enabled Severity Fidelity* CVE-2014-6327 S840 4832/0 Microsoft Internet Explorer Memory Corruption Yes High 85 CVE-2014-6328 S840 4819/0 Microsoft Internet Explorer XSS Filter Bypass Yes High 80 CVE-2014-6329 S840 4824/0 Microsoft Internet Explorer Memory Corruption Yes High 80 CVE-2014-6330 S840 4826/0 Microsoft Internet Explorer 11 Memory Corruption Yes High 85 CVE-2014-6365 S840 4833/0 Microsoft Internet Explorer Cross-Site Scripting Vulnerability Yes High 85 CVE-2014-6366 S840 4821/0 Microsoft Internet Explorer Memory Corruption Vulnerability Yes High 85 CVE-2014-6369 S840 4813/0 Microsoft Internet Explorer Memory Corruption Yes High 85 CVE-2014-6373 S840 4817/0 Microsoft Internet Explorer Memory Corruption Yes High 80 CVE-2014-6374 S840 4814/0 Microsoft Internet Explorer Remote Code Execution Yes High 80 CVE-2014-6376 S840 4815/0 Microsoft Internet Explorer Remote Code Execution Yes High 80 CVE-2014-8966 S840 4816/0 Microsoft Internet Explorer Remote Code Execution Yes High 80 CVE-2014-6325 S840 4787/0 Microsoft Exchange Server Security Feature Bypass Yes High 80 CVE-2014-6326 S840 4785/0 Microsoft Exchange Server Security Feature Bypass Yes High 85 CVE-2014-6355 S840 4825/0 Microsoft Graphics Component Information Disclosure Yes Low 80 CVE-2014-6357 S840 4823/0 Microsoft Office Word Use after Free Yes High 80
* Fidelity is also referred to as Signature Fidelity Rating (SFR) and is the relative measure of the accuracy of the signature (predefined). The value ranges from 0 through 100 and is set by Cisco Systems, Inc.
Administrators can configure Cisco IPS sensors to perform an event action when an attack is detected. The configured event action performs preventive or deterrent controls to help protect against an attack that is attempting to exploit the vulnerabilities listed in the preceding table.
Cisco IPS sensors are most effective when deployed in inline protection mode combined with the use of an event action. Automatic Threat Prevention for Cisco IPS 7.x and 6.x sensors that are deployed in inline protection mode provides threat prevention against an attack that is attempting to exploit the vulnerability that is described in this document. Threat prevention is achieved through a default override that performs an event action for triggered signatures with a riskRatingValue greater than 90.
For additional information about the risk rating and threat rating calculation, reference Risk Rating and Threat Rating: Simplify IPS Policy Management.
For information about using Cisco Security Manager to view the activity from a Cisco IPS sensor, see Identification of Malicious Traffic Using Cisco Security Manager white paper.
Sourcefire Signature Information
The following Sourcefire Snort signatures are available for the Microsoft December 2014 Security Update.
Microsoft Advisory ID Microsoft Advisory Name CVE(s) Applicable Rules MS14-075 Vulnerabilities in Microsoft Exchange Server Could Allow Elevation of Privilege CVE-2014-6319, CVE-2014-6325, CVE-2014-6326, CVE-2014-6336 1:32681, 1:32682, 1:32705 MS14-080 Cumulative Security Update for Internet Explorer CVE-2014-6327 through CVE-2014-6330, CVE-2014-6363, CVE-2014-6365, CVE-2014-6366, CVE-2014-6368, CVE-2014-6369, CVE-2014-6373 through CVE-2014-6376, and CVE-2014-8966 1:32679, 1:32680, 1:32685, 1:32686, 1:32689 through 1:32694, 1:32703, 1:32704, 1:32709 1:32710, 1:32713 through 1:32717, and 1:32720 through 1:32725 MS14-081 Vulnerabilities in Microsoft Word and Office Web Apps Could Allow Remote Code Execution CVE-2014-6356 and CVE-2014-6357 1:32707, 1:32708, 1:32711, and 1:32712 MS14-082 Vulnerabilities in Microsoft Office Could Allow Remote Code Execution CVE-2014-6364 1:32687 and 1:32688 MS14-083 Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution CVE-2014-6360 and CVE-2014-6361 1:32683, 1:32684, 1:32718, and 1:32719 MS14-084 Vulnerability in VBScript Scripting Engine Could Allow Remote Code Execution CVE-2014-6363 1:32709 MS14-085 Vulnerability in Microsoft Graphics Component Could Allow Information Disclosure CVE-2014-6355 1:32695 through 1:32702
For information about using Sourcefire Snort and Sourcefire Next Generation IPS, reference Sourcefire Next-Generation Security.
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
-
Show LessVersion Description Section Date 2 Sourcefire signature information is available for the December 2014 Microsoft Security Bulletins. 2014-December-09 22:23 GMT 1 Cisco Applied Mitigation Bulletin initial public release 2014-December-09 19:01 GMT
-
Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt.
-
The security vulnerability applies to the following combinations of products.
Primary Products Microsoft, Inc. Exchange Server 2007 (SP3) | 2010 (SP3) | 2013 (CU6, SP1) Internet Explorer 6.0 (Base, SP1, SP2) | 7.0 (Base) | 8.0 (Base) | 9.0 (Base) | 10.0 (Base) | 11.0 (Base) Microsoft Office Excel Viewer 2007 (Base, SP1, SP2) Microsoft VBScript 5.8 (Base) Office 2007 (SP3) | 2010 (SP1, SP2) | 2013 (32-bit editions, 32-bit editions Service Pack 1, 64-bit editions, 64-bit editions Service Pack 1) | 2013 RT (Base, Service Pack 1) Office Compatibility Pack Original Release (SP3) | SP3 (Base) Office for Mac 2011 (Base) Windows 7 for 32-bit systems (SP1) | for x64-based systems (SP1) Windows 8 for 32-bit systems (Base) | for x64-based systems (Base) Windows 8.1 for 32-bit Systems (Base) | for x64-based Systems (Base) Windows RT Original Release (Base) | 8.1 (Base) Windows Server 2003 Datacenter Edition (SP2) | Datacenter Edition, 64-bit (Itanium) (SP2) | Datacenter Edition x64 (AMD/EM64T) (SP2) | Enterprise Edition (SP2) | Enterprise Edition, 64-bit (Itanium) (SP2) | Enterprise Edition x64 (AMD/EM64T) (SP2) | Standard Edition (SP2) | Standard Edition, 64-bit (Itanium) (SP2) | Standard Edition x64 (AMD/EM64T) (SP2) | Web Edition (SP2) Windows Server 2008 Datacenter Edition (SP2) | Datacenter Edition, 64-bit (SP2) | Itanium-Based Systems Edition (SP2) | Enterprise Edition (SP2) | Enterprise Edition, 64-bit (SP2) | Essential Business Server Standard (SP2) | Essential Business Server Premium (SP2) | Essential Business Server Premium, 64-bit (SP2) | Standard Edition (SP2) | Standard Edition, 64-bit (SP2) | Web Server (SP2) | Web Server, 64-bit (SP2) Windows Server 2008 R2 x64-Based Systems Edition (SP1) | Itanium-Based Systems Edition (SP1) Windows Server 2012 Original Release (Base) Windows Server 2012 R2 Original Release (Base) Windows Vista Home Basic (SP2) | Home Premium (SP2) | Business (SP2) | Enterprise (SP2) | Ultimate (SP2) | Home Basic x64 Edition (SP2) | Home Premium x64 Edition (SP2) | Business x64 Edition (SP2) | Enterprise x64 Edition (SP2) | Ultimate x64 Edition (SP2) Word Viewer Original Release (Base) SharePoint Foundation 2010 (SP2) | 2013 (Base, SP1) Office Web Apps 2010 (SP2) | 2013 (Base, SP1)
Associated Products Microsoft, Inc. Windows 7 for 32-bit systems | for x64-based systems Windows 8 for 32-bit systems | for x64-based systems Windows 8.1 for 32-bit Systems | for x64-based Systems Windows RT Original Release | 8.1 Windows Server 2003 Datacenter Edition | Datacenter Edition, 64-bit (Itanium) | Datacenter Edition x64 (AMD/EM64T) | Enterprise Edition | Enterprise Edition, 64-bit (Itanium) | Enterprise Edition x64 (AMD/EM64T) | Standard Edition | Standard Edition, 64-bit (Itanium) | Standard Edition x64 (AMD/EM64T) | Web Edition Windows Server 2008 Datacenter Edition | Datacenter Edition, 64-bit | Itanium-Based Systems Edition | Enterprise Edition | Enterprise Edition, 64-bit | Essential Business Server Standard | Essential Business Server Premium | Essential Business Server Premium, 64-bit | Standard Edition | Standard Edition, 64-bit | Web Server | Web Server, 64-bit Windows Server 2008 R2 x64-Based Systems Edition | Itanium-Based Systems Edition Windows Server 2012 Original Release Windows Server 2012 R2 Original Release Windows Vista Home Basic | Home Premium | Business | Enterprise | Ultimate | Home Basic x64 Edition | Home Premium x64 Edition | Business x64 Edition | Enterprise x64 Edition | Ultimate x64 Edition
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.
A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products