PT-2014-1733 · Microsoft · Windows 8.1+8

Ryujin · Published 2014-10-14 · Updated 2025-04-07 · CVE-2014-4113

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT Gold and 8.1

Description The issue is related to the improper handling of objects in memory by the kernel-mode driver in Windows, allowing an attacker to gain privileges via a crafted application. This could enable the attacker to run arbitrary code in kernel mode, install programs, view, change, or delete data, or create new accounts with full administrative rights. The vulnerability has been exploited in the wild.

Recommendations For Windows Server 2003 SP2, update to a newer version to mitigate the risk. For Windows Vista SP2, update to a newer version to mitigate the risk. For Windows Server 2008 SP2 and R2 SP1, update to a newer version to mitigate the risk. For Windows 7 SP1, update to a newer version to mitigate the risk. For Windows 8, update to a newer version to mitigate the risk. For Windows 8.1, update to a newer version to mitigate the risk. For Windows Server 2012 Gold and R2, update to a newer version to mitigate the risk. For Windows RT Gold and 8.1, update to a newer version to mitigate the risk. As a temporary workaround, consider disabling the SeDebugPrivilege privilege until a patch is available. Restrict access to the win32k.sys driver to minimize the risk of exploitation. Avoid using the winlogon API until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-00747

CVE-2014-4113

Affected Products

Windows

Windows 7

Windows 8

Windows 8.1

Windows Rt

Windows Server 2003

Windows Server 2008

Windows Server 2012

Windows Vista

References · 30

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms14_058_track_popup_menu.rb · Exploit
• 🔥 https://github.com/sam-b/CVE-2014-4113 · Exploit
• 🔥 https://github.com/johnjohnsp1/CVE-2014-4113 · Exploit
• 🔥 https://github.com/nsxz/Exploit-CVE-2014-4113 · Exploit
• 🔥 https://exploit-db.com/exploits/37064 · Exploit
• 🔥 http://exploit-db.com/exploits/35101 · Exploit
• 🔥 https://exploit-db.com/exploits/46945 · Exploit
• 🔥 http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-a-windows-kernel-mode-vulnerability-cve-2014-4113 · Exploit
• 🔥 https://exploit-db.com/exploits/39666 · Exploit
• 🔥 http://packetstormsecurity.com/files/131964/Windows-8.0-8.1-x64-TrackPopupMenu-Privilege-Escalation.html · Exploit
• 🔥 https://exploit-db.com/exploits/35101 · Exploit
• http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-058 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-4113 · Security Note
• https://bdu.fstec.ru/vul/2015-00747 · Security Note