PT-2014-1668 · Microsoft · .Net Framework

Publicado 2014-02-11 · Atualizado 2025-03-27 · CVE-2014-0257

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 1.0 SP3 through 4.5.1

Description The issue allows an attacker to elevate privileges on the targeted system. It exists due to improper determination of whether it is safe to execute a method, which allows remote attackers to execute arbitrary code via a crafted web site or a crafted .NET Framework application that exposes a COM server endpoint.

Recommendations For Microsoft .NET Framework versions 1.0 SP3 through 4.5.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2015-00602

CVE-2014-0257

Produtos afetados

.Net Framework

Referências · 17

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms14_009_ie_dfsvc.rb · Exploit
• 🔥 https://github.com/T3nb3w/ComDotNetExploit · Exploit
• 🔥 https://exploit-db.com/exploits/33892 · Exploit
• 🔥 http://exploit-db.com/exploits/33892 · Exploit
• https://github.com/tyranid/IE11SandboxEscapes · Nota
• https://github.com/xforcered/ForsHops · Nota
• http://technet.microsoft.com/en-us/security/bulletin/ms14-009 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-0257 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-00602 · Nota de Segurança
• https://t.me/aptreports/17267 · Publicação no Telegram
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0257 · Nota de Segurança
• http://osvdb.org/103163 · Nota
• http://securitytracker.com/id/1029745 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-009 · Aviso do Fabricante
• http://secunia.com/advisories/56793 · Nota