Assessing risk for the March 2014 security updates

Today we released five security bulletins addressing 23 unique CVE’s. Two bulletins have a maximum severity rating of Critical while the other three have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your environment.

Bulletin

Most likely attack vector

Max Bulletin Severity

Max Exploit-ability

Likely first 30 days impact

Platform mitigations and key notes

MS14-012(Internet Explorer)

Victim browses to a malicious webpage.

Critical

1

Likely to see reliable exploits developed within next 30 days.

Addresses vulnerability described by Security Advisory 2934088, an issue under targeted attack.

MS14-013(DirectShow)

Victim browses to a malicious webpage.

Critical

3

Unlikely to see reliable exploits developed within next 30 days.

Addresses single double-free issue in qedit.dll, reachable via a malicious webpage.

MS14-014(Silverlight)

Attacker combines this vulnerability with a (separate) code execution vulnerability to execute arbitrary code in the browser security context.

Important

n/a

No chance for direct code execution with this vulnerability.

This vulnerability does not result in code execution directly. However, it is a component attackers could use to bypass ASLR.

MS14-015(Kernel mode drivers)

Attacker running code at low privilege runs exploit binary to elevate to SYSTEM.

Important

1

Likely to see reliable exploits developed within next 30 days.

MS14-016(Security Account Manager)

Attacker able to make API calls to security account manager password API able to brute-force password guessing attempts without triggering account lockout policy.

Important

n/a

No chance for direct code execution with this vulnerability.

Attacker must authenticate before calling the affected API. After authenticating, the attacker can choose to guess either their own or other user’s password without risk of lockout.

- Jonathan Ness, MSRC engineering team