PT-2014-1021 · Microsoft · Windows Rt+9

Stefan Kanthak · Published 2014-04-08 · Updated 2020-07-24 · CVE-2014-0315

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions XP SP2 through XP SP3 Microsoft Windows Server versions 2003 SP2 through 2008 SP2 and 2008 R2 SP1 Microsoft Windows versions Vista SP2 through 8.1 Microsoft Windows Server versions 2012 through 2012 R2 Microsoft Windows RT versions Gold through 8.1

Description The issue allows local users to gain privileges via a Trojan horse cmd.exe file in the current working directory. This can be demonstrated by a directory that contains a .bat or .cmd file. The vulnerability is related to the handling of .bat and .cmd files launched from an external network, which can be exploited to gain full control over the system. This allows an attacker to install programs, view, modify, or delete data, and create new accounts with full user rights. Users with limited system rights are less exposed to this issue than users working with administrator rights.

Recommendations For Microsoft Windows XP SP2 and SP3, consider disabling the execution of .bat and .cmd files from external sources until a fix is available. For Microsoft Windows Server 2003 SP2, restrict access to the cmd.exe file to minimize the risk of exploitation. For Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1, avoid using .bat and .cmd files from untrusted sources. For Microsoft Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1, apply configuration changes to limit the execution of external .bat and .cmd files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Untrusted Search Path

Weakness Enumeration

CWE-119

CWE-426

Related Identifiers

BDU:2014-00084

CVE-2014-0315

Affected Products

Windows 7

Windows 8

Windows 8.1

Windows Rt

Windows Server 2003

Windows Server 2008

Windows Server 2012

Windows Vista

Windows Xp

Cmd.Exe

References · 8

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-019 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0315 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-0315 · Security Note
• https://bdu.fstec.ru/vul/2014-00084 · Security Note
• https://t.me/defcon_news/52866 · Telegram Post
• http://seclists.org/fulldisclosure/2020/Jul/33 · Note
• http://technet.microsoft.com/ru-ru/security/bulletin/ms14-019 · Note
• http://blogs.technet.com/b/srd/archive/2014/04/08/ms14-019-fixing-a-binary-hijacking-via-cmd-or-bat-file.aspx · Note