PT-2014-1183 · Microsoft · Windows Server 2008 R2+2

Pawel Wylecial · Published 2014-05-14 · Updated 2018-10-12 · CVE-2014-0256

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2008 SP2 Microsoft Windows Server 2008 R2 SP1 Microsoft Windows Server 2012 Gold

Description The issue is related to errors in processing iSCSI connections, which can be exploited to cause a denial of service. This can be achieved by sending many crafted packets, resulting in an iSCSI service outage.

Recommendations For Microsoft Windows Server 2008 SP2, update the iSCSI service to prevent denial of service attacks. For Microsoft Windows Server 2008 R2 SP1, restrict access to the iSCSI target service until a patch is available. For Microsoft Windows Server 2012 Gold, consider disabling the iSCSI target service as a temporary workaround until a fix is provided.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2014-00337

CVE-2014-0256

Affected Products

Windows Server 2008 R2 Sp1

Windows Server 2008 R2

Windows Server 2012

References · 5

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-028 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0256 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0256 · Security Note
• https://bdu.fstec.ru/vul/2014-00337 · Security Note
• http://technet.microsoft.com/ru-ru/security/bulletin/ms14-028 · Note