NVD

Id
32829  
Name
CVE-2014-4971  
Description
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.  
Reject
 
CVSS Version
2  
CVSS Score
7.2  
Severity
High  
CVSS Base Score
7.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2014-07-26  
Modified Date
2017-01-06  
Seq
2014-4971  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
172438 32829 CVE-2014-4971 http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx  View
172439 32829 CVE-2014-4971 http://packetstormsecurity.com/files/127535/Microsoft-XP-SP3-BthPan.sys-Arbitrary-Write-Privilege-Escalation.html  View
172440 32829 CVE-2014-4971 http://packetstormsecurity.com/files/127536/Microsoft-XP-SP3-MQAC.sys-Arbitrary-Write-Privilege-Escalation.html  View
172441 32829 CVE-2014-4971 http://packetstormsecurity.com/files/128674/Microsoft-Bluetooth-Personal-Area-Networking-BthPan.sys-Privilege-Escalation.html  View
172442 32829 CVE-2014-4971 20140718 KL-001-2014-002 : Microsoft XP SP3 BthPan.sys Arbitrary Write Privilege Escalation  View
172443 32829 CVE-2014-4971 20140718 KL-001-2014-003 : Microsoft XP SP3 MQAC.sys Arbitrary Write Privilege Escalation  View
172444 32829 CVE-2014-4971 MS14-062  View
172445 32829 CVE-2014-4971 34112  View
172446 32829 CVE-2014-4971 34131  View
172447 32829 CVE-2014-4971 34982  View
172448 32829 CVE-2014-4971 20140718 KL-001-2014-002 : Microsoft XP SP3 BthPan.sys Arbitrary Write Privilege Escalation  View
172449 32829 CVE-2014-4971 20140718 KL-001-2014-003 : Microsoft XP SP3 MQAC.sys Arbitrary Write Privilege Escalation  View
172450 32829 CVE-2014-4971 68764  View
172451 32829 CVE-2014-4971 1031025  View
172452 32829 CVE-2014-4971 https://www.korelogic.com/Resources/Advisories/KL-001-2014-002.txt  View
172453 32829 CVE-2014-4971 https://www.korelogic.com/Resources/Advisories/KL-001-2014-003.txt  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
14720 JVNDB-2014-003595 Microsoft Windows XP および Microsoft Windows Server 2003 における任意のメモリ領域にデータを書き込まれる脆弱性 Microsoft Windows XP および Microsoft Windows Server 2003 は、特定の IRP ハンドラのルーチンのアドレスを検証しないため、任意のメモリ領域にデータを書き込まれ、その結果、権限を取得される脆弱性が存在します。 CVE-2014-4971 72260 CVE-2014-4971 32829 7.2 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003595.html 2014-07-18 2014-10-21 View