PT-2014-1665 · Microsoft · .Net Framework

Published 2014-10-14 · Updated 2018-10-12 · CVE-2014-4121

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 SP2 through 4.5.2

Description A remote code execution issue exists due to the improper handling of internationalized resource identifiers. This allows an attacker to gain complete control over the system, enabling them to install programs, view, change, or delete data, and create new accounts with full user rights. Users with limited system rights are less affected than those operating with administrative rights.

Recommendations For Microsoft .NET Framework versions 2.0 SP2 through 4.5.2, update to a version that includes the fix for this issue to prevent remote code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-00599

CVE-2014-4121

Affected Products

.Net Framework

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2014-4121 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4121 · Security Note
• https://bdu.fstec.ru/vul/2015-00599 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-057 · Vendor Advisory
• http://securityfocus.com/bid/70351 · Note
• http://secunia.com/advisories/60969 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms14-057 · Note
• http://securitytracker.com/id/1031021 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4121 · Note