PT-2014-5510 · Microsoft · Dia Sdk+1

Published 2014-05-14 · Updated 2016-09-09 · CVE-2014-3802

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Visual Studio versions prior to 2013

Description The issue arises from improper validation of an unspecified variable in the msdia.dll file within Microsoft Debug Interface Access (DIA) SDK. This leads to potential memory corruption when calculating a dynamic-call address, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted PDB file.

Recommendations For versions prior to 2013, consider restricting access to the msdia.dll file until a fix is available. As a temporary workaround, avoid using crafted PDB files that could trigger the memory corruption issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-3802

ZDI-14-129

Affected Products

Dia Sdk

Visual Studio

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-3802 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-14-129 · Security Note
• http://securityfocus.com/bid/67398 · Note
• http://zerodayinitiative.com/advisories/ZDI-14-129 · Note