| Vulnerability Name: | CVE-2014-4971 (CCN-94753) | ||||||||
| Assigned: | 2014-07-18 | ||||||||
| Published: | 2014-07-18 | ||||||||
| Updated: | 2018-10-12 | ||||||||
| Summary: | Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem. CWE-123: Write-what-where Condition CWE-123: Write-what-where Condition | ||||||||
| CVSS v3 Severity: | 9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||||
| CVSS v2 Severity: | 7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C) 5.6 Medium (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:UR)
5.6 Medium (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:UR)
| ||||||||
| Vulnerability Type: | CWE-20 | ||||||||
| Vulnerability Consequences: | Gain Privileges | ||||||||
| References: | Source: CCN Type: BugTraq Mailing List, Fri Jul 18 2014 - 13:43:51 CDT KL-001-2014-002 : Microsoft XP SP3 BthPan.sys Arbitrary Write Privilege Escalation Source: CCN Type: BugTraq Mailing List, Fri Jul 18 2014 - 15:42:42 CDT KL-001-2014-003 : Microsoft XP SP3 MQAC.sys Arbitrary Write Privilege Escalation Source: CONFIRM Type: Vendor Advisory http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx Source: MITRE Type: CNA CVE-2014-4971 Source: MISC Type: UNKNOWN http://packetstormsecurity.com/files/127535/Microsoft-XP-SP3-BthPan.sys-Arbitrary-Write-Privilege-Escalation.html Source: MISC Type: UNKNOWN http://packetstormsecurity.com/files/127536/Microsoft-XP-SP3-MQAC.sys-Arbitrary-Write-Privilege-Escalation.html Source: MISC Type: Exploit, VDB Entry http://packetstormsecurity.com/files/128674/Microsoft-Bluetooth-Personal-Area-Networking-BthPan.sys-Privilege-Escalation.html Source: FULLDISC Type: Exploit 20140718 KL-001-2014-002 : Microsoft XP SP3 BthPan.sys Arbitrary Write Privilege Escalation Source: FULLDISC Type: Exploit 20140718 KL-001-2014-003 : Microsoft XP SP3 MQAC.sys Arbitrary Write Privilege Escalation Source: SECUNIA Type: Permissions Required 60974 Source: CCN Type: Microsoft Security Bulletin MS14-062 Vulnerability in Message Queuing Service Could Allow Elevation of Privilege (2993254) Source: EXPLOIT-DB Type: Exploit 34112 Source: EXPLOIT-DB Type: UNKNOWN 34131 Source: EXPLOIT-DB Type: Exploit 34982 Source: OSVDB Type: Broken Link 109387 Source: BUGTRAQ Type: UNKNOWN 20140718 KL-001-2014-002 : Microsoft XP SP3 BthPan.sys Arbitrary Write Privilege Escalation Source: BUGTRAQ Type: UNKNOWN 20140718 KL-001-2014-003 : Microsoft XP SP3 MQAC.sys Arbitrary Write Privilege Escalation Source: BID Type: UNKNOWN 68764 Source: CCN Type: BID-68764 Multiple Microsoft Products Arbitrary Memory Write Privilege Escalation Vulnerabilities Source: SECTRACK Type: Third Party Advisory, VDB Entry 1031025 Source: MS Type: UNKNOWN MS14-062 Source: XF Type: UNKNOWN ms-cve20144971-priv-esc(94753) Source: CCN Type: Packet Storm Security [07-21-2014] Microsoft XP SP3 BthPan.sys Arbitrary Write Privilege Escalation Source: CCN Type: Packet Storm Security [07-25-2014] MQAC.sys Arbitrary Write Privilege Escalation Source: CCN Type: Packet Storm Security [10-15-2014] Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [07-19-2014] Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [07-21-2014] Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [07-25-2014] Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [10-15-2014] Source: MISC Type: Exploit https://www.korelogic.com/Resources/Advisories/KL-001-2014-002.txt Source: MISC Type: Exploit https://www.korelogic.com/Resources/Advisories/KL-001-2014-003.txt | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||