CVE-2014-6352
Published: 22 October 2014
Summary
CVE-2014-6352 is a high-severity an unspecified weakness vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-3 (Malicious Code Protection) and AC-6 (Least Privilege).
Deeper analysis
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 contain a vulnerability that permits remote attackers to execute arbitrary code through a crafted OLE object. The flaw received a CVSS score of 7.8 and was assigned CWE NVD-CWE-noinfo.
Attackers can deliver the exploit via malicious documents, such as a specially crafted PowerPoint file, enabling them to run arbitrary code on affected systems when the document is opened. The vulnerability was actively exploited in the wild during October 2014.
Public advisories, including the Microsoft Security Research and Defense blog post on November 2014 updates and entries from Secunia, SecurityFocus, and SecurityTracker, address risk assessment and available patches for the issue.
The vulnerability saw confirmed real-world exploitation through PowerPoint documents in October 2014, prior to the release of corresponding security updates.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2014-6236
Vulnerability details
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted…
more
OLE object, as exploited in the wild in October 2014 with a crafted PowerPoint document.
- CWE(s)
- KEV Date Added
- 25 February 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks execution of the crafted OLE object delivered in the malicious PowerPoint document.
Disables or restricts OLE and document-processing features that the exploit relies on to achieve code execution.
Limits privileges of the process handling the opened document so arbitrary code cannot fully compromise the system.