This affects not just Windows but other operating systems Tuesday’s disclosure means that every major TLS stack—including Apple SecureTransport, GNUTLS, OpenSSL, NSS, and now Microsoft SChannel—has had a severe vulnerability this year. In some cases, the flaws merely allowed attackers to bypass encryption protections, while others—most notably the Heartbleed bug in OpenSSL and the one patched Tuesday in Windows, allowed adversaries to steal highly sensitive data and execute malicious code on vulnerable systems respectively.
Here is the Microsoft update
Published: November 11, 2014
Version: 1.0
On this page
- Executive Summary
- Affected Software
- Update FAQ
- Severity Ratings and Vulnerability Identifiers
- Microsoft Schannel Remote Code Execution Vulnerability – CVE-2014-6321
- Security Update Deployment
- Acknowledgments
- Disclaimer
- Revisions
This security update resolves a privately reported vulnerability in the Microsoft Secure Channel (Schannel) security package in Windows. The vulnerability could allow remote code execution if an attacker sends specially crafted packets to a Windows server.
This security update is rated Critical for all supported releases of Microsoft Windows. For more information, see the Affected Software section.
The security update addresses the vulnerability by correcting how Schannel sanitizes specially crafted packets. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability.
Technorati Tags: Bug allowing execution of malicious code resides in TLS stack,TLS Bug