PT-2014-1736 · Microsoft · Windows Vista+3

Icewall + 1 · Publicado 2014-10-14 · Atualizado 2019-02-26 · CVE-2014-4115

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2003 SP2 Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2

Description The issue exists due to the way the Windows FASTFAT system driver interacts with FAT32 disk partitions. This allows an attacker to execute arbitrary code with elevated privileges by connecting a crafted USB device. The vulnerability can be exploited by physically proximate attackers.

Recommendations For Microsoft Windows Server 2003 SP2, update the FASTFAT driver to a patched version. For Microsoft Windows Vista SP2, update the FASTFAT driver to a patched version. For Microsoft Windows Server 2008 SP2, update the FASTFAT driver to a patched version. As a temporary workaround, consider restricting access to USB devices to minimize the risk of exploitation.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

BDU:2015-00750

CVE-2014-4115

Produtos afetados

Windows

Windows Server 2003

Windows Server 2008

Windows Vista

Referências · 8

• http://secunia.com/advisories/60975 · Nota
• https://bdu.fstec.ru/vul/2015-00750 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4115 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-063 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-4115 · Nota de Segurança
• http://technet.microsoft.com/en-us/security/bulletin/ms14-063 · Nota
• http://securityfocus.com/bid/70343 · Nota
• http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx · Aviso do Fabricante