The Patching Friars' AlmanacA calendar of CVE saints

October 14

SandwormHoly card for sandworm, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 Sandworm VERMIS ARENAE
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint Sandworm, the Worm of the Sands

Patron of PowerPoint attachments, OLE objects, and Dune readers who leave quotes in their code.

Life

On 14 October 2014 iSIGHT Partners revealed that a Russian espionage group was using an unknown Windows vulnerability against NATO, the Ukrainian government and energy companies: a PowerPoint presentation with an OLE object downloaded and ran files from a remote share, no macros needed. The group was named Sandworm after the Dune references found in its campaigns, and the name has stuck to it through every attack since.

Prayer

O Saint Sandworm, who swims in the sands of attachments, let our presentations contain only boring slides. Amen.

How to celebrate

Celebrated by installing update MS14-060 and walking without rhythm, so as not to attract the worms.

Open every attachment and the worm will come.

Technical record

Disclosed on
October 14 2014
CVE
CVE-2014-4114
CVSS
7.8Actively exploited (CISA KEV)
Product
Microsoft · Windows

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a "Sandworm" attack in June through October 2014, aka "Windows OLE Remote Code Execution Vulnerability."

Sources: isightpartners.com · web.archive.org · learn.microsoft.com

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.