MS KB3010060: Vulnerability in Microsoft OLE Could Allow Remote Code Execution (deprecated)

High Nessus Plugin ID 78627


The remote host is affected by a remote code execution vulnerability.


The remote host is missing one of the workarounds referenced in Microsoft Security Advisory 3010060.

The version of Microsoft Office installed on the remote host is affected by a remote code execution vulnerability due to a flaw in the OLE package manager. A remote attacker can exploit this vulnerability by convincing a user to open an Office file containing specially crafted OLE objects, resulting in execution of arbitrary code in the context of the current user.


Apply the Microsoft Fix it solution 'OLE packager Shim Workaround' or deploy the Enhanced Mitigation Experience Toolkit (EMET) 5.0 and configure Attack Surface Reduction with the settings provided by Microsoft.

See Also

Plugin Details

Severity: High

ID: 78627

File Name: smb_kb3010060.nasl

Version: $Revision: 1.7 $

Type: local

Agent: windows

Family: Windows

Published: 2014/10/22

Modified: 2017/08/30

Dependencies: 13855, 49675

Risk Information

Risk Factor: High


Base Score: 9.3

Temporal Score: 8.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:ND/RL:W/RC:C

Vulnerability Information

CPE: cpe:/o:microsoft:windows, cpe:/a:microsoft:office

Required KB Items: SMB/Registry/Enumerated, SMB/WindowsVersion

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2014/10/21

Exploitable With

Metasploit (MS14-060 Microsoft Windows OLE Package Manager Code Execution)

Reference Information

CVE: CVE-2014-6352

BID: 70690

OSVDB: 113140

MSKB: 3010060