# MA-370.012014: MyCERT Alert - Microsoft Security Bulletin Summary For January 2014

**Date:** 16 Jan 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-370.012014  
**Advisory ID:** MA-370.012014

---

**1.0 Introduction**
Microsoft had released the January Security Bulletins–four Important–which addressed unique CVEs in Microsoft Word and Office Web Apps, Windows Kernel, and Microsoft Dynamics AX. These vulnerabilities could allow remote code execution, elevation of privilege and denial of service. With the release of this security bulletins for January 2014, this bulletin summary replaces the bulletin advance notification originally issued in January 9, 2014 by Microsoft.
**2.0 The list of the Important vulnerabilities are as below:**
> **2.1 Vulnerabilities in Microsoft Word and Office Web Apps Could Allow Remote Code Execution (2916605)**
>
> This security update resolves three privately reported vulnerabilities in Microsoft Office. The vulnerabilities could allow remote code execution if a specially crafted file is opened in an affected version of Microsoft Word or other affected Microsoft Office software. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
>
> - Patch: <https://technet.microsoft.com/en-us/security/bulletin/ms14-001>
>
> **2.2 Vulnerability in Windows Kernel Could Allow Elevation of Privilege (2914368)**
>
> This security update resolves a publicly disclosed vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker logs on to a system and runs specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability.
>
> - Patch: <https://technet.microsoft.com/en-us/security/bulletin/ms14-002>
>
> **2.3 Vulnerability in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2913602)**
>
> This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if a user logs on to a system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability.
>
> - Patch: <https://technet.microsoft.com/en-us/security/bulletin/ms14-003>
>
> **2.4 Vulnerability in Microsoft Dynamics AX Could Allow Denial of Service (2880826)**
>
> This security update resolves one privately reported vulnerability in Microsoft Dynamics AX. The vulnerability could allow denial of service if an authenticated attacker submits specially crafted data to an affected Microsoft Dynamics AX Application Object Server (AOS) instance. An attacker who successfully exploited this vulnerability could cause the target AOS instance to stop responding to client requests.
>
> - Patch: <https://technet.microsoft.com/en-us/security/bulletin/ms14-004>
**3.0 Recommendation**
Users are recommended to perform the update immediately. All of the patches could be done almost automatically via the Windows Update application.
The how-to perform of the Windows Update is available at the following URL:
- [https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4
)
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#63001a0106115a5a5a23001a01061110060016110a171a4d0e1a) or [[email protected]](/cdn-cgi/l/email-protection#81ecf8e2e4f3f5c1ecf8e2e4f3f5afeef3e6afecf8)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: <https://www.mycert.org.my>
**4.0 References**
- <https://technet.microsoft.com/en-us/security/bulletin/ms14-jan>
- <http://www.us-cert.gov/ncas/current-activity/2014/01/14/Microsoft-Releases-January-2014-Security-Bulletin>