PT-2014-5698 · Microsoft · Internet Information Services

Published 2014-11-11 · Updated 2025-07-21 · CVE-2014-4078

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Information Services (IIS) versions 8.0 through 8.5

Description The IP Security feature in Microsoft Internet Information Services (IIS) does not properly process wildcard allow and deny rules for domains within the "IP Address and Domain Restrictions" list. This makes it easier for remote attackers to bypass an intended rule set via an HTTP request.

Recommendations For IIS versions 8.0 through 8.5, consider reconfiguring the "IP Address and Domain Restrictions" list to avoid using wildcard rules until a proper fix is available. As a temporary workaround, restrict access to sensitive areas of the web server to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-4078

Affected Products

Internet Information Services

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2014-4078 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-076 · Vendor Advisory
• https://twitter.com/ErichKron/status/1937509088143053166 · Twitter Post
• http://securitytracker.com/id/1031194 · Note
• https://twitter.com/INTERCERTUSA/status/1947255619175477273 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4078 · Note
• http://securityfocus.com/bid/70937 · Note