Security Experts:

Connect with us

Hi, what are you looking for?



Multiple Patch Tuesday Vulnerabilities Under Attack

It is a busy day in the world of Microsoft security.

It is a busy day in the world of Microsoft security.

Tucked within the security bulletins released today are a number of vulnerabilities that have come under attack. Two of them are zero-days affecting the Windows kernel – CVE-2014-4148 and CVE-2014-4113 – and are fixed in MS14-058.

“In the case of CVE-2014-4148, the attackers exploited a vulnerability in the Microsoft Windows TrueType Font (TTF) processing subsystem, using a Microsoft Office document to embed and deliver a malicious TTF to an internal organization,” according to researchers at FireEye, who found the bug. “Since the embedded TTF is processed in kernel-­‐mode, successful exploitation granted the attackers kernel-­‐mode access. Though the TTF is delivered in a Microsoft Office document, the vulnerability does not reside within Microsoft Office.”

CVE-2014-4148 impacts both 32-­bit and 64­‐bit Windows operating systems, though the attacks only targeted 32-bit systems. The malware contained within the exploit has specific functions adapted to the following operating system platforms: Windows 8.1/Windows Server 2012 R2; Windows 8/Windows Server 2012; Windows 7/Windows Server 2008 R2 (Service Pack 0 and 1); and Windows XP Service Pack.

“Since TTF exploits target the underlying operating system, the vulnerability can be exploited through multiple attack vectors, including web pages,” explained researchers with FireEye. “In the past, exploit it authors have converted a similar exploit (CVE-2011-3402) for us in browser-based attacks.”

In this case, the TTF exploit is packaged within a Microsoft Office file.

CVE-­2014-­4113 meanwhile can be used against Microsoft Windows 7, Vista, XP, Windows 2000, Windows Server 2003/R2 and Windows Server 2008/R2 to escalate privileges locally. The vulnerability cannot be used on its own to compromise a customer’s security; instead, an attacker would first need to gain access to a remote system running any of the aforementioned operating systems so they could execute code within the context of the Windows kernel, FireEye explained.

An investigation by FireEye has uncovered evidence that attackers have likely used variations of these exploits for a while. Windows 8 and Windows Server 2012 and later are not susceptible to the issue.  

“We have no evidence of these exploits being used by the same actors. Instead, we have only observed each exploit being used separately, in unrelated cases,” according to FireEye.

The revelations come as details have emerged about hackers using CVE-2014-4114 [MS14-60] to spy on NATO, the European Union, Ukraine and private energy and telecommunications companies. According to iSight Partners, the group began five years ago. The campaign was discovered to be targeting CVE-2014-4114 in August, and the group’s methods have evolved over time.

“We are attributing this particular cyber-espionage campaign to a…team that iSIGHT has dubbed ‘Sandworm Team’ based on its use of encoded references to the classic science fiction series Dune in command and control URLs and various malware samples,” according to the company. “The team has been previously referred to as [Quedagh] by F-Secure, which detailed elements of this campaign in 2014 but only captured a small component of the activities and failed to detail the use of the zero-day vulnerability.”

According to iSight Partners, the vulnerability exists because Windows allows the OLE packager (packager .dll) to download and execute INF files. In the case of the observed exploit, specifically when handling Microsoft PowerPoint files, the packagers allows a Package OLE object to reference arbitrary external files, such as INF files, from untrusted sources, iSight explained in an advisory.

*This story was updated to clarify when the Sandworm Team was formed.

Written By

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.


GoAnywhere MFT users warned about a zero-day remote code injection exploit that can be targeted directly from the internet