PT-2014-1278 · Microsoft · Dynamics Ax

Andrey Maykov · Published 2014-01-15 · Updated 2018-10-12 · CVE-2014-0261

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Dynamics AX versions 4.0 SP2, 2009 SP1, 2012, and 2012 R2

Description The issue is related to the improper handling of specially crafted messages in the AOS format, leading to a denial of service (instance outage). This can be caused by remote authenticated users sending crafted data to an Application Object Server (AOS) instance.

Recommendations For Microsoft Dynamics AX versions 4.0 SP2, 2009 SP1, 2012, and 2012 R2, consider restricting access to the AOS instance to minimize the risk of exploitation. As a temporary workaround, consider implementing additional validation for incoming data to the AOS instance until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-00041

CVE-2014-0261

Affected Products

Dynamics Ax

References · 6

• https://bdu.fstec.ru/vul/2015-00041 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0261 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0261 · Security Note
• http://technet.microsoft.com/library/security/ms14-004 · Note
• http://securitytracker.com/id/1029601 · Note