MS14-007: Vulnerability in Direct2D Could Allow Remote Code Execution (2912390)

This security update resolves a privately reported vulnerability in Microsoft Windows.


Microsoft Security Bulletin MS14-007 - Critical

Vulnerability in Direct2D Could Allow Remote Code Execution (2912390)

Published: Tuesday, February 11, 2014

Version: 1.0


General Information

Executive Summary

This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker would have no way to force users to view specially crafted content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an Instant Messenger message that takes users to an attacker's website, or by getting them to open an attachment sent through email.

This security update is rated Critical for all supported editions of Windows 7, Windows 2008 R2, Windows 8, Windows Server 2012, Windows RT, Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1. For more information, see the subsection, Affected and Non-Affected Software, in this section.

The security update addresses the vulnerability by correcting the way that Direct2D handles objects in memory. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.

Recommendation. Most customers have automatic updating enabled and will not need to take any action because this security update will be downloaded and installed automatically. Customers who have not enabled automatic updating need to check for updates and install this update manually. For information about specific configuration options in automatic updating, see Microsoft Knowledge Base Article 294871.

For administrators and enterprise installations, or end users who want to install this security update manually, Microsoft recommends that customers apply the update immediately using update management software, or by checking for updates using the Microsoft Update service.

See also the section, Detection and Deployment Tools and Guidance, later in this bulletin.
Top of section
Knowledge Base Article





Knowledge Base Article

2912390


File information Yes
SHA1/SHA2 hashes Yes
Known issues None
Top of section
Affected and Non-Affected Software

The following software has been tested to determine which versions or editions are affected. Other versions or editions are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see Microsoft Support Lifecycle.

Affected Software







Operating System

Maximum Security Impact

Aggregate Severity Rating

Updates Replaced



Windows 7


Windows 7 for 32-bit Systems Service Pack 1
(2912390) Remote Code Execution Critical None
Windows 7 for x64-based Systems Service Pack 1
(2912390) Remote Code Execution Critical None


Windows Server 2008 R2


Windows Server 2008 R2 for x64-based Systems Service Pack 1
(2912390) Remote Code Execution Critical None


Windows 8 and Windows 8.1


Windows 8 for 32-bit Systems
(2912390) Remote Code Execution Critical None
Windows 8 for x64-based Systems
(2912390) Remote Code Execution Critical None
Windows 8.1 for 32-bit Systems
(2912390) Remote Code Execution Critical None
Windows 8.1 for x64-based Systems
(2912390) Remote Code Execution Critical None


Windows Server 2012 and Windows Server 2012 R2


Windows Server 2012
(2912390) Remote Code Execution Critical None
Windows Server 2012 R2
(2912390) Remote Code Execution Critical None


Windows RT and Windows RT 8.1


Windows RT[1]
(2912390) Remote Code Execution Critical None
Windows RT 8.1[1]
(2912390) Remote Code Execution Critical None

[1]This update is available via Windows Update.



Non-Affected Software




Operating System


Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2  
Windows Server 2003 Service Pack 2  
Windows Server 2003 x64 Edition Service Pack 2  
Windows Server 2003 with SP2 for Itanium-based Systems  
Windows Vista Service Pack 2  
Windows Vista x64 Edition Service Pack 2  
Windows Server 2008 for 32-bit Systems Service Pack 2  
Windows Server 2008 for x64-based Systems Service Pack 2  
Windows Server 2008 for Itanium-based Systems Service Pack 2  
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1


Server Core installation option


Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)  
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)  
Windows Server 2012 (Server Core installation)  
Windows Server 2012 R2 (Server Core installation)  
Top of section
Update FAQ












Vulnerability Information

Severity Ratings and Vulnerability Identifiers


The following severity ratings assume the potential maximum impact of the vulnerability. For information regarding the likelihood, within 30 days of this security bulletin's release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the February bulletin summary. For more information, see Microsoft Exploitability Index.

Vulnerability Severity Rating and Maximum Security Impact by Affected Software






Affected Software

Microsoft Graphics Component Memory Corruption Vulnerability - CVE-2014-0263

Aggregate Severity Rating



Windows 7


Windows 7 for 32-bit Systems Service Pack 1  Critical
Remote Code Execution  Critical
Windows 7 for x64-based Systems Service Pack 1  Critical
Remote Code Execution  Critical


Windows Server 2008 R2


Windows Server 2008 R2 for x64-based Systems Service Pack 1  Critical
Remote Code Execution  Critical


Windows 8 and Windows 8.1


Windows 8 for 32-bit Systems Critical
Remote Code Execution  Critical
Windows 8 for x64-based Systems  Critical
Remote Code Execution  Critical
Windows 8.1 for 32-bit Systems  Critical
Remote Code Execution  Critical
Windows 8.1 for x64-based Systems  Critical
Remote Code Execution  Critical


Windows Server 2012 and Windows Server 2012 RT


Windows Server 2012  Critical
Remote Code Execution  Critical
Windows Server 2012 R2  Critical
Remote Code Execution  Critical


Windows Server RT and Windows RT 8.1


Windows RT  Critical
Remote Code Execution  Critical
Windows RT 8.1  Critical
Remote Code Execution  Critical
Top of section
Microsoft Graphics Component Memory Corruption Vulnerability - CVE-2014-0263


A remote code execution vulnerability exists in the way that affected Windows components handle specially crafted 2D geometric figures. The vulnerability could allow remote code execution if a user views files containing such specially crafted figures using Internet Explorer. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.

To view this vulnerability as a standard entry in the Common Vulnerabilities and Exposures list, see CVE-2014-0263.

Mitigating Factors


Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:
In a web-based attack scenario, an attacker could take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by getting them to open an attachment sent through email.
An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Top of section
Workarounds


Microsoft has not identified any workarounds for this vulnerability.
Top of section
FAQ


What is the scope of the vulnerability?
This is a remote code execution vulnerability.

What causes the vulnerability?
The vulnerability is caused when Direct2D fails to properly handle a specially crafted 2D geometric figure.

What is Direct2D?
Direct2D is a hardware-accelerated, immediate-mode 2-D graphics API that provides high performance and high-quality rendering for 2-D geometry, bitmaps, and text. The Direct2D API is designed to interoperate with existing code that uses GDI, GDI+, or Direct3D. For more information about Direct2D, see the MSDN article, Direct2D.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could cause arbitrary code to run with the privileges of the user who opens a specially crafted file or browses a website that contains specially crafted content. If the user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

How could an attacker exploit the vulnerability?
An attacker could exploit the vulnerability by hosting a specially crafted website that is designed to invoke Direct2D through Internet Explorer. This can also include compromised websites and websites that accept or host user-provided content. These websites could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action. For example, an attacker could trick users into clicking a link that takes them to the attacker's site.

In a file sharing attack scenario, an attacker could provide a specially crafted file that is designed to exploit this vulnerability, and then convince a user to open the file.

What systems are primarily at risk from the vulnerability?
Workstations and terminal servers are primarily at risk.

Note For systems running Windows 7 and Windows Server 2008 R2, these systems are at risk from the vulnerability only if they have platform update 2670838 installed.

What does the update do?
The update addresses the vulnerability by correcting the way that Direct2D handles arbitrarily large geometric figures.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
No. Microsoft received information about this vulnerability through coordinated vulnerability disclosure.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.
Top of sectionTop of section
Update Information

Detection and Deployment Tools and Guidance


Several resources are available to help administrators deploy security updates.
Microsoft Baseline Security Analyzer (MBSA) lets administrators scan local and remote systems for missing security updates and common security misconfigurations.
Windows Server Update Services (WSUS), Systems Management Server (SMS), and System Center Configuration Manager help administrators distribute security updates.
The Update Compatibility Evaluator components included with Application Compatibility Toolkit aid in streamlining the testing and validation of Windows updates against installed applications.

For information about these and other tools that are available, see Security Tools for IT Pros.
Top of section
Security Update Deployment


Affected Software

For information about the specific security update for your affected software, click the appropriate link:

Windows 7 (all editions)


Reference Table

The following table contains the security update information for this software.




Security update file name For all supported 32-bit editions of Windows 7:
Windows6.1-KB2912390-x86.msu
For all supported x64-based editions of Windows 7:
Windows6.1-KB2912390-x64.msu
Installation switches See Microsoft Knowledge Base Article 934307  
Restart requirement In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.
Removal information To uninstall an update installed by WUSA, use the /Uninstall setup switch or click Control Panel, click System and Security, and then under Windows Update, click View installed updates and select from the list of updates.
File information See Microsoft Knowledge Base Article 2912390  
Registry key verification Note A registry key does not exist to validate the presence of this update.
Top of section
Windows Server 2008 R2 (all editions)


Reference Table

The following table contains the security update information for this software.




Security update file name For all supported x64-based editions of Windows Server 2008 R2:
Windows6.1-KB2912390-x64.msu
Installation switches See Microsoft Knowledge Base Article 934307
Restart requirement In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.
Removal information To uninstall an update installed by WUSA, use the /Uninstall setup switch or click Control Panel, click System and Security, and then under Windows Update, click View installed updates and select from the list of updates.
File information See Microsoft Knowledge Base Article 2912390  
Registry key verification Note A registry key does not exist to validate the presence of this update.
Top of section
Windows 8 and Windows 8.1 (all editions)


Reference Table

The following table contains the security update information for this software.




Security update file name For all supported 32-bit editions of Windows 8:
Windows8-RT-KB2912390-x86.msu
For all supported x64-based editions of Windows 8:
Windows8-RT-KB2912390-x64.msu
For all supported 32-bit editions of Windows 8.1:
Windows8.1-KB2912390-x86.msu
For all supported x64-based editions of Windows 8.1:
Windows8.1-KB2912390-x64.msu
Installation switches See Microsoft Knowledge Base Article 934307
Restart requirement In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.
Removal information To uninstall an update installed by WUSA, use the /Uninstall setup switch or click Control Panel, click System and Security, click Windows Update, and then under See also, click Installed updates and select from the list of updates.
File information See Microsoft Knowledge Base Article 2912390  
Registry key verification Note A registry key does not exist to validate the presence of this update.
Top of section
Windows Server 2012 and Windows Server 2012 R2 (all editions)


Reference Table

The following table contains the security update information for this software.




Security update file name For all supported editions of Windows Server 2012:
Windows8-RT-KB2912390-x64.msu
For all supported editions of Windows Server 2012 R2:
Windows8.1-KB2912390-x64.msu
Installation switches See Microsoft Knowledge Base Article 934307
Restart requirement In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.
Removal information To uninstall an update installed by WUSA, use the /Uninstall setup switch or click Control Panel, click System and Security, click Windows Update, and then under See also, click Installed updates and select from the list of updates.
File information See Microsoft Knowledge Base Article 2912390  
Registry key verification Note A registry key does not exist to validate the presence of this update.
Top of section
Windows RT and Windows RT 8.1 (all editions)


The following table contains the security update information for this software.




Deployment These updates are available via Windows Update only.
Restart Requirement In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.
Removal Information Click Control Panel, click System and Security, click Windows Update, and then under See also, click Installed updates and select from the list of updates.
File Information See Microsoft Knowledge Base Article 2912390  
Top of sectionTop of section
Other Information

Acknowledgments

Microsoft thanks the following for working with us to help protect customers:
Omair, working with HP's Zero Day Initiative, for reporting the Microsoft Graphics Component Memory Corruption Vulnerability (CVE-2014-0263)
Top of section
Microsoft Active Protections Program (MAPP)

To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please go to the active protections websites provided by program partners, listed in Microsoft Active Protections Program (MAPP) Partners.
Top of section
Support

How to obtain help and support for this security update
Help installing updates: Support for Microsoft Update
Security solutions for IT professionals: TechNet Security Troubleshooting and Support
Help protect your computer that is running Windows from viruses and malware: Virus Solution and Security Center
Local support according to your country: International Support
Top of section
Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Top of section
Revisions
V1.0 (February 11, 2014): Bulletin published.
Подписывайтесь на каналы "SecurityLab" в TelegramTelegram и Яндекс.ДзенЯндекс.Дзен, чтобы первыми узнавать о новостях и эксклюзивных материалах по информационной безопасности.