Microsoft Windows Remote Desktop Protocol CVE-2014-6318 Security Bypass Vulnerability

Bugtraq ID:	70981
Class:	Design Error
CVE:	CVE-2014-6318
Remote:	Yes
Local:	No
Published:	Nov 11 2014 12:00AM
Updated:	Nov 11 2014 12:00AM
Credit:	Microsoft
Vulnerable:	Microsoft Windows Vista SP2 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for 32-bit Systems SP1
Not Vulnerable:

Microsoft Windows Remote Desktop Protocol CVE-2014-6318 Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Microsoft Windows 8.1 for x64-based Systems 0

• Microsoft Security Update for Windows 8.1 for x64-based Systems (KB3003743)
  http://www.microsoft.com/downloads/details.aspx?familyid=5B060F4A-9D0F -48F1-A75F-E870639682E1

Microsoft Windows Vista SP2

• Microsoft Security Update for Windows Vista (KB3003743)
  http://www.microsoft.com/downloads/details.aspx?familyid=cd274873-4374 -4251-8df5-40bef3cf6769

Microsoft Windows 8 for 32-bit Systems 0

• Microsoft Security Update for Windows 8 (KB3003743)
  http://www.microsoft.com/downloads/details.aspx?familyid=DB9A3D8C-E090 -4E62-80B9-79BA72EB6B1F

Microsoft Windows 7 for 32-bit Systems SP1

• Microsoft Security Update for Windows 7 (KB3003743)
  http://www.microsoft.com/downloads/details.aspx?familyid=BA3EE706-5F13 -4D94-96F0-18D651AC24A5

Microsoft Windows Server 2008 R2 for x64-based Systems SP1

• Microsoft Security Update for Windows Server 2008 R2 x64 Edition (KB3003743)
  http://www.microsoft.com/downloads/details.aspx?familyid=1F04EC23-74C0 -44C5-9DFF-A385BD2640D2

Microsoft Windows 7 for x64-based Systems SP1

• Microsoft Security Update for Windows 7 for x64-based Systems (KB3003743)
  http://www.microsoft.com/downloads/details.aspx?familyid=BEE56DA6-17CF -4F6A-B873-4E71D56A4DFE

Microsoft Windows Server 2008 for Itanium-based Systems SP2

• Microsoft Security Update for Windows Server 2008 for Itanium-based Systems (KB3003743)
  http://www.microsoft.com/downloads/details.aspx?familyid=24DF37A6-58F5 -4653-B7CF-680F13E4812C

Microsoft Windows Server 2012 0

• Microsoft Security Update for Windows Server 2012 (KB3003743)
  http://www.microsoft.com/downloads/details.aspx?familyid=3F1CF267-DE68 -4EA8-8B4F-8ED9905AC881

Microsoft Windows Server 2008 for 32-bit Systems SP2

• Microsoft Security Update for Windows Server 2008 (KB3003743)
  http://www.microsoft.com/downloads/details.aspx?familyid=747DBADF-2564 -4619-BD2F-0D8ABF8D9CC1

Microsoft Windows 8 for x64-based Systems 0

• Microsoft Security Update for Windows 8 for x64-based Systems (KB3003743)
  http://www.microsoft.com/downloads/details.aspx?familyid=09796A5D-71A6 -48E8-8B52-7242C41A9123

Microsoft Windows Server 2012 R2 0

• Microsoft Security Update for Windows Server 2012 R2 (KB3003743)
  http://www.microsoft.com/downloads/details.aspx?familyid=EE55F2C0-291A -43B3-9BF3-D4651F355477

Microsoft Windows 8.1 for 32-bit Systems 0

• Microsoft Security Update for Windows 8.1 (KB3003743)
  http://www.microsoft.com/downloads/details.aspx?familyid=DE14AE5C-FA0B -4885-BE24-99CF3E80F803

Microsoft Windows Server 2008 for x64-based Systems SP2

• Microsoft Security Update for Windows Server 2008 x64 Edition (KB3003743)
  http://www.microsoft.com/downloads/details.aspx?familyid=334503CD-1148 -4773-A9A8-AFAEEF7CA2A5

Microsoft Windows Remote Desktop Protocol CVE-2014-6318 Security Bypass Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• Microsoft Security Bulletin MS14-074 (Microsoft)