PT-2014-1278 · Microsoft · Dynamics Ax

Andrey Maykov · Publicado 2014-01-15 · Atualizado 2018-10-12 · CVE-2014-0261

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Dynamics AX versions 4.0 SP2, 2009 SP1, 2012, and 2012 R2

Description The issue is related to the improper handling of specially crafted messages in the AOS format, leading to a denial of service (instance outage). This can be caused by remote authenticated users sending crafted data to an Application Object Server (AOS) instance.

Recommendations For Microsoft Dynamics AX versions 4.0 SP2, 2009 SP1, 2012, and 2012 R2, consider restricting access to the AOS instance to minimize the risk of exploitation. As a temporary workaround, consider implementing additional validation for incoming data to the AOS instance until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2015-00041

CVE-2014-0261

Produtos afetados

Dynamics Ax

Referências · 6

• http://technet.microsoft.com/library/security/ms14-004 · Nota
• https://bdu.fstec.ru/vul/2015-00041 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-004 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-0261 · Nota de Segurança
• http://securitytracker.com/id/1029601 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0261 · Nota de Segurança