Issue References

For more information about this issue, see the following references:

This advisory discusses the following software.

Affected Software

What is the scope of the advisory?
Microsoft is investigating reports of a vulnerability in affected releases of Microsoft Windows.

Is this a security vulnerability that requires Microsoft to issue a security update?
On completion of our investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through our monthly security update release process, or an out-of-cycle security update, depending on customer needs.

What is OLE?
OLE (Object Linking and Embedding) is a technology that allows applications to share data and functionality, such as the ability to create and edit compound data. Compound data is data that contains information in multiple formats. For example, a compound Microsoft Word document may contain an embedded Microsoft Excel spreadsheet (or OLE object). This technology also enables in-place editing; instead of launching a new application when an OLE object is activated, the user instead sees a new set of menu items inside their existing application. For more information about OLE, see Compound Documents.

What is the difference between Microsoft PowerPoint Presentation and PowerPoint Show files?
Microsoft PowerPoint Presentation files (.PPTX or .PPT file extensions) commonly open in edit mode. Microsoft PowerPoint Show files (.PPSX or .PPS file extensions) commonly open in presentation mode. PowerPoint Show files may be shared with users who do not intend to edit the file.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

How could an attacker exploit the vulnerability?
User interaction is required to exploit this vulnerability.

In an email attack scenario, an attacker could exploit the vulnerability by sending a specially-crafted file to the user. For this attack scenario to be successful, the user must be convinced to open the specially crafted file containing the malicious OLE object. All Microsoft Office file types as well as many other third-party file types could contain a malicious OLE object.

In a web-based attack scenario, an attacker would have to host a website that contains a specially crafted Microsoft Office file, such as a PowerPoint file, that is used in an attempt to exploit this vulnerability. In addition, compromised websites (and websites that accept or host user-provided content) could contain specially crafted content that could exploit this vulnerability. An attacker would have no method to force users to visit a malicious website. Instead, an attacker would have to persuade the targeted user to visit the website, typically by getting them to click a hyperlink that directs a web browser to the attacker-controlled website.

What is User Account Control?
User Account Control (UAC) is a Windows security component that allows an administrator to enter credentials during a non-administrative user session to perform occasional administrative tasks.

What systems are primarily at risk from the vulnerability?
Servers or workstations that open documents with embedded OLE objects are primarily at risk.

Apply Workarounds

Workarounds refer to a setting or configuration change that does not correct the underlying issue but would help block known attack vectors before a security update is available. See the next section, Workarounds, for more information.

Workarounds

• Apply the Microsoft Fix it solution, "OLE packager Shim Workaround", that prevents exploitation of the vulnerability
  See Microsoft Knowledge Base Article 3010060 to use the automated Microsoft Fix it solution to enable or disable this workaround.
  

  Note:
  The Fix it solution is available for Microsoft PowerPoint on 32-bit and x64-based editions of Microsoft Windows, with the exception of 64-bit editions of PowerPoint on x64-based editions of Windows 8 and Windows 8.1.

• Do not open Microsoft PowerPoint files, or other files, from untrusted sources
  Do not open Microsoft PowerPoint files that you receive from untrusted sources or that you receive unexpectedly from trusted sources. This vulnerability could be exploited when a user opens a specially crafted file.
• Enable User Account Control (UAC)
  Note User Account Control is enabled by default.
  1. Do one of the following to open Control Panel:
     1. Click Start, and then click Control Panel.
     2. Press the Windows logo key + s, type Control Panel, then open the Control Panel app.
  2. In Control Panel, click User Accounts (or User Accounts and Family Safety).
  3. In the User Accounts window, click User Accounts.
  4. In the User Accounts tasks window, click Turn User Account Control on or off (or Change User Account Control settings).
  5. If UAC is currently configured in Admin Approval Mode, a UAC message appears; click Continue.
  6. Click the check box "Use User Account Control (UAC) to help protect your computer", and then click OK.
  7. Do one of the following:
     1. Click Restart Now to apply the change right away.
     2. Click Restart Later.
  8. Close the User Accounts tasks window.
• Deploy the Enhanced Mitigation Experience Toolkit 5.0 and configure Attack Surface Reduction
  The Attack Surface Reduction feature in EMET 5.0 can help block current attacks. You need to add configuration to the standard one in order to be protected.
  1. Create a new file with the content below:
     Copy

      <EMET Version="5.0.5324.31801"> <Settings /> <EMET_Apps> <AppConfig Path="*" Executable="dllhost.exe"> <Mitigation Name="DEP" Enabled="false" /> <Mitigation Name="SEHOP" Enabled="false" /> <Mitigation Name="NullPage" Enabled="false" /> <Mitigation Name="HeapSpray" Enabled="false" /> <Mitigation Name="EAF" Enabled="false" /> <Mitigation Name="EAF+" Enabled="false" /> <Mitigation Name="MandatoryASLR" Enabled="false" /> <Mitigation Name="BottomUpASLR" Enabled="false" /> <Mitigation Name="LoadLib" Enabled="false" /> <Mitigation Name="MemProt" Enabled="false" /> <Mitigation Name="Caller" Enabled="false" /> <Mitigation Name="SimExecFlow" Enabled="false" /> <Mitigation Name="StackPivot" Enabled="false" /> <Mitigation Name="ASR" Enabled="true"> <asr_modules>packager.dll</asr_modules> </Mitigation> </AppConfig> <AppConfig Path="*\OFFICE1*" Executable="POWERPNT.EXE"> <Mitigation Name="DEP" Enabled="true" /> <Mitigation Name="SEHOP" Enabled="true" /> <Mitigation Name="NullPage" Enabled="true" /> <Mitigation Name="HeapSpray" Enabled="true" /> <Mitigation Name="EAF" Enabled="true" /> <Mitigation Name="EAF+" Enabled="false" /> <Mitigation Name="MandatoryASLR" Enabled="true" /> <Mitigation Name="BottomUpASLR" Enabled="true" /> <Mitigation Name="LoadLib" Enabled="true" /> <Mitigation Name="MemProt" Enabled="true" /> <Mitigation Name="Caller" Enabled="true" /> <Mitigation Name="SimExecFlow" Enabled="true" /> <Mitigation Name="StackPivot" Enabled="true" /> <Mitigation Name="ASR" Enabled="true"> <asr_modules>flash*.ocx;packager.dll</asr_modules> </Mitigation> </AppConfig> </EMET_Apps> </EMET> 

  2. Save this file as EMET_CVE-2014-6352.xml.
  3. From the EMET user interface, click Import from the File ribbon.
  4. Select the EMET_CVE-2014-6352.xml file and click Open.
  5. Alternatively, run this command from a Command Prompt with elevated privileges to import the saved script "EMET_CVE-2014-6532.xml" into EMET:
     Copy

      EMET_Conf.exe --import EMET_CVE-2014-6352.xml   

Additional Suggested Actions

• Protect your PC

  We continue to encourage customers to follow our Protect Your Computer guidance of enabling a firewall, getting software updates and installing antivirus software. For more information, see Microsoft Safety & Security Center.

• Keep Microsoft Software Updated

  Users running Microsoft software should apply the latest Microsoft security updates to help make sure that their computers are as protected as possible. If you are not sure whether your software is up to date, visit Microsoft Update, scan your computer for available updates, and install any high-priority updates that are offered to you. If you have automatic updating enabled and configured to provide updates for Microsoft products, the updates are delivered to you when they are released, but you should verify that they are installed.

Microsoft thanks the following for working with us to help protect customers:

• Drew Hintz, Shane Huntley, and Matty Pellegrino of the Google Security Team
• Haifei Li and Bing Sun of the McAfee Security Team

Microsoft Active Protections Program (MAPP)

To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please visit the active protections websites provided by program partners, listed in Microsoft Active Protections Program (MAPP) Partners.

Feedback

• You can provide feedback by completing the Microsoft Help and Support form, Customer Service Contact Us.

Support

• Customers in the United States and Canada can receive technical support from Security Support. For more information, see Microsoft Help and Support.
• International customers can receive support from their local Microsoft subsidiaries. For more information, see International Support.
• Microsoft TechNet Security provides additional information about security in Microsoft products.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

• V1.0 (October 21, 2014): Advisory published.