PT-2014-1668 · Microsoft · .Net Framework

Published 2014-02-11 · Updated 2025-03-27 · CVE-2014-0257

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 1.0 SP3 through 4.5.1

Description The issue allows an attacker to elevate privileges on the targeted system. It exists due to improper determination of whether it is safe to execute a method, which allows remote attackers to execute arbitrary code via a crafted web site or a crafted .NET Framework application that exposes a COM server endpoint.

Recommendations For Microsoft .NET Framework versions 1.0 SP3 through 4.5.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-00602

CVE-2014-0257

Affected Products

.Net Framework

References · 17

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms14_009_ie_dfsvc.rb · Exploit
• 🔥 https://github.com/T3nb3w/ComDotNetExploit · Exploit
• 🔥 https://exploit-db.com/exploits/33892 · Exploit
• 🔥 http://exploit-db.com/exploits/33892 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-0257 · Security Note
• https://bdu.fstec.ru/vul/2015-00602 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0257 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-009 · Vendor Advisory
• https://github.com/tyranid/IE11SandboxEscapes · Note
• https://github.com/xforcered/ForsHops · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms14-009 · Note
• https://t.me/aptreports/17267 · Telegram Post
• http://osvdb.org/103163 · Note
• http://securitytracker.com/id/1029745 · Note
• http://secunia.com/advisories/56793 · Note