Microsoft Security Advisory 3010060: Vulnerability in Microsoft OLE Could Allow Remote Code Execution (Published: October 21, 2014)

PowerPoint Zero Day Vulnerability Executive Summary:

Microsoft is aware of a vulnerability affecting all supported releases of Microsoft Windows, excluding Windows Server 2003. The vulnerability could allow remote code execution if a user opens a specially crafted Microsoft Office file that contains an OLE object. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. The attack requires user interaction to succeed on Windows clients with a default configuration, as User Account Control (UAC) is enabled and a consent prompt is displayed.

At this time, we are aware of limited, targeted attacks that attempt to exploit the vulnerability through Microsoft PowerPoint.

PowerPoint Zero Day Mitigating Factors:

 

• n observed attacks, User Account Control (UAC) displays a consent prompt or an elevation prompt, depending on the privileges of the current user, before a file containing the exploit is executed. UAC is enabled by default on Windows Vista and newer releases of Microsoft Windows.
• An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
• In a web-based attack scenario, an attacker could host a website that contains a webpage that contains a specially crafted Office file that is used to attempt to exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these websites. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes users to the attacker’s website.
• Files from the Internet and from other potentially unsafe locations can contain viruses, worms, or other kinds of malware that can harm your computer. To help protect your computer, files from these potentially unsafe locations are opened in Protected View. By using Protected View, you can read a file and see its contents while reducing the risks. Protected View is enabled by default.

 

EMET 5 Mitigation:

Deploy the Enhanced Mitigation Experience Toolkit 5.0 and configure Attack Surface Reduction
The Attack Surface Reduction feature in EMET 5.0 can help block current attacks. You need to add configuration to the standard one in order to be protected.

1. Create a new file with the content below:

   <EMET Version="5.0.5324.31801">
     <Settings />
     <EMET_Apps>
       <AppConfig Path="*" Executable="dllhost.exe">
         <Mitigation Name="DEP" Enabled="false" />
         <Mitigation Name="SEHOP" Enabled="false" />
         <Mitigation Name="NullPage" Enabled="false" />
         <Mitigation Name="HeapSpray" Enabled="false" />
         <Mitigation Name="EAF" Enabled="false" />
         <Mitigation Name="EAF+" Enabled="false" />
         <Mitigation Name="MandatoryASLR" Enabled="false" />
         <Mitigation Name="BottomUpASLR" Enabled="false" />
         <Mitigation Name="LoadLib" Enabled="false" />
         <Mitigation Name="MemProt" Enabled="false" />
         <Mitigation Name="Caller" Enabled="false" />
         <Mitigation Name="SimExecFlow" Enabled="false" />
         <Mitigation Name="StackPivot" Enabled="false" />
         <Mitigation Name="ASR" Enabled="true">
           <asr_modules>packager.dll</asr_modules>
         </Mitigation>
       </AppConfig>
       <AppConfig Path="*\OFFICE1*" Executable="POWERPNT.EXE">
         <Mitigation Name="DEP" Enabled="true" />
         <Mitigation Name="SEHOP" Enabled="true" />
         <Mitigation Name="NullPage" Enabled="true" />
         <Mitigation Name="HeapSpray" Enabled="true" />
         <Mitigation Name="EAF" Enabled="true" />
         <Mitigation Name="EAF+" Enabled="false" />
         <Mitigation Name="MandatoryASLR" Enabled="true" />
         <Mitigation Name="BottomUpASLR" Enabled="true" />
         <Mitigation Name="LoadLib" Enabled="true" />
         <Mitigation Name="MemProt" Enabled="true" />
         <Mitigation Name="Caller" Enabled="true" />
         <Mitigation Name="SimExecFlow" Enabled="true" />
         <Mitigation Name="StackPivot" Enabled="true" />
         <Mitigation Name="ASR" Enabled="true">
           <asr_modules>flash*.ocx;packager.dll</asr_modules>
         </Mitigation>
       </AppConfig>
     </EMET_Apps>
   </EMET>
   

2. Save this file as EMET_CVE-2014-6352.xml.
3. From the EMET user interface, click Import from the File ribbon.
4. Select the EMET_CVE-2014-6352.xml file and click Open.
5. Alternatively, run this command from a Command Prompt with elevated privileges to import the saved script “EMET_CVE-2014-6532.xml” into EMET:

   EMET_Conf.exe  --import EMET_CVE-2014-6352.xml

Microsoft : https://technet.microsoft.com/library/security/3010060