PT-2014-5510 · Microsoft · Dia Sdk+1

Publicado 2014-05-14 · Atualizado 2016-09-09 · CVE-2014-3802

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Visual Studio versions prior to 2013

Description The issue arises from improper validation of an unspecified variable in the msdia.dll file within Microsoft Debug Interface Access (DIA) SDK. This leads to potential memory corruption when calculating a dynamic-call address, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted PDB file.

Recommendations For versions prior to 2013, consider restricting access to the msdia.dll file until a fix is available. As a temporary workaround, avoid using crafted PDB files that could trigger the memory corruption issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-3802

ZDI-14-129

Produtos afetados

Dia Sdk

Visual Studio

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-3802 · Nota de Segurança
• http://securityfocus.com/bid/67398 · Nota
• https://zerodayinitiative.com/advisories/ZDI-14-129 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-14-129 · Nota