# MA-430.112014: MyCERT Alert - Microsoft Windows OLE Automation Array Remote Code Execution Vulnerability

**Date:** 17 Nov 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-430.112014  
**Advisory ID:** MA-430.112014

---

**1.0     Introduction**
A vulnerability in Microsoft Windows Object Linking and Embedding (OLE) could allow remote code execution if a user views a specially-crafted web page in Internet Explorer. The CVE names are CVE-2014-6352 and CVE-2014-6332.
**2.0     Impact**
These updates address vulnerabilities that could potentially allow an attacker to run arbitrary code on the computer with user privileges. If the user is an administrator, the attacker may run arbitrary code as an administrator, fully compromising the system.
**3.0 Affected Products**
Listed below are the affected products:
- Microsoft Windows Vista, 7, 8, 8.1, RT, and RT 8.1
- Microsoft Server 2003, Server 2008, Server 2008 R2, Server 2012, and Server 2012 R2
**4.0 Recommendation**
MyCERT recommends users to update their software by following these instructions below:
4.1 An update is available from Microsoft Security Bulletin [MS14-064](https://technet.microsoft.com/library/security/MS14-064). Please refer MyCERT Alert on Microsoft Security Bulletin for November for more details and mitigation guidance, and apply the necessary updates:
<https://www.mycert.org.my/portal/advisory?id=MA-427.112014>
4.2 Users for Windows OLE Remote Code Execution Vulnerability (CVE-2014-6352) can use the following detail steps as a workaround against this exploit:
- Apply the Microsoft Fix it solution, "OLE packager Shim Workaround", that prevents exploitation of the vulnerability.
See [Microsoft Knowledge Base Article 3010060](https://support.microsoft.com/kb/3010060) to use the automated Microsoft Fix it solution to enable or disable this workaround.
- Do not open Microsoft PowerPoint files, or other files, from untrusted sources.
- Enable User Account Control (UAC).
**Note**: User Account Control is enabled by default.
- Deploy the Enhanced Mitigation Experience Toolkit 5.0 and configure Attack Surface Reduction
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : <https://www.mycert.org.my>
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0     References**
- Microsoft Windows OLE Automation Array Remote Code Execution Vulnerability
<https://www.us-cert.gov/ncas/alerts/TA14-318B>
- Microsoft Windows: Execute arbitrary code/commands - Remote with user
<https://www.auscert.org.au/render.html?it=21139>
- Microsoft Security Bulletin MS14-064 - Critical
<https://technet.microsoft.com/en-us/library/security/ms14-064>