KB2914486 relevant but should be superseded

Usage and Config Patch
1

(imported topic written by Niall.Fraser)

Hi,

I have found that many of the servers on my estate are showing fixlets for KB2914486

2914486: Microsoft Security Advisory - Vulnerability in Microsoft Windows Kernel Could Allow Elevation of Privilege - Enable workaround - Windows XP SP3 / Windows Server 2003 SP2

as relevant, however when I look at the KB in Technet, it says that the vulnerability was addressed in MS14-002. As the servers have MS14-002 installed - should this workaround still be showing as relevant? The relevance does not look for the presence of MS14-002, but I wonder if it should

the technet entry for MS14-002 is however a bit confusing as it says that it also addresses the vulnerability found in KB2814486 (typo) but if you click on the hyperlink it takes you to KB2914486, so that may be why the relevance has not been changed

I would be grateful if this could be investigated.

thanks

Niall

2

(imported comment written by sylviabeing)

Hi Niall,

Thanks for bringing it up!

Actually we are aware of the supersedence for SA 2914486. The SA was released in Nov 2013 and we have provided both enabling and disabling workaround fixlets. However we didn’t formally supersede the content for SA 2914486 when MS14-002 was published, because the patch in MS14-002 is a formal fix for the issue but it may not disable the workaround enabled by the enabling fixlet.

It seems that the “Enable workaround” fixlet is giving issue. We will look into it and respond to it soon.

Thanks again!

Regards,

Sylvia