PT-2014-1665 · Microsoft · .Net Framework

Publicado 2014-10-14 · Atualizado 2018-10-12 · CVE-2014-4121

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 SP2 through 4.5.2

Description A remote code execution issue exists due to the improper handling of internationalized resource identifiers. This allows an attacker to gain complete control over the system, enabling them to install programs, view, change, or delete data, and create new accounts with full user rights. Users with limited system rights are less affected than those operating with administrative rights.

Recommendations For Microsoft .NET Framework versions 2.0 SP2 through 4.5.2, update to a version that includes the fix for this issue to prevent remote code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

BDU:2015-00599

CVE-2014-4121

Produtos afetados

.Net Framework

Referências · 9

• http://securityfocus.com/bid/70351 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-4121 · Nota de Segurança
• http://secunia.com/advisories/60969 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4121 · Nota de Segurança
• http://technet.microsoft.com/en-us/security/bulletin/ms14-057 · Nota
• https://bdu.fstec.ru/vul/2015-00599 · Nota de Segurança
• http://securitytracker.com/id/1031021 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-057 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4121 · Nota