Attacker Value

Unknown

(0 users assessed)

Exploitability

Unknown

(0 users assessed)

User Interaction

Unknown

Privileges Required

Unknown

Attack Vector

Unknown

0

CVE-2014-4971

Disclosure Date: July 26, 2014 •

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Metasploit Module

MS14-062 Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation

MQAC.sys Arbitrary Write Privilege Escalation

Description

Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

None

Impact Score:

Unknown

Exploitability Score:

Unknown

Vector:

Attack Vector (AV):

Unknown

Attack Complexity (AC):

Unknown

Privileges Required (PR):

Unknown

User Interaction (UI):

Unknown

Scope (S):

Unknown

Confidentiality (C):

Unknown

Integrity (I):

Unknown

Availability (A):

Unknown

Vendors

microsoft

Products

windows xp

Metasploit Modules

MS14-062 Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation (https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/bthpan.rb)

MQAC.sys Arbitrary Write Privilege Escalation (https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/mqac_write.rb)

References

Canonical

CVE-2014-4971 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4971)

BID-68764 (http://www.securityfocus.com/bid/68764)

Advisory

SECTRACK-1031025 (http://www.securitytracker.com/id/1031025)

MS14-062 (https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-062)

http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx

20140718 KL-001-2014-003 : Microsoft XP SP3 MQAC.sys Arbitrary Write Privilege Escalation (http://www.securityfocus.com/archive/1/532844/100/0/threaded)

EXPLOIT-DB-34112 (http://www.exploit-db.com/exploits/34112)

EXPLOIT-DB-34131 (http://www.exploit-db.com/exploits/34131)

EXPLOIT-DB-34982 (http://www.exploit-db.com/exploits/34982)

20140718 KL-001-2014-003 : Microsoft XP SP3 MQAC.sys Arbitrary Write Privilege Escalation (http://seclists.org/fulldisclosure/2014/Jul/97)

20140718 KL-001-2014-002 : Microsoft XP SP3 BthPan.sys Arbitrary Write Privilege Escalation (http://www.securityfocus.com/archive/1/532843/100/0/threaded)

OSVDB-109387 (http://www.osvdb.org/109387)

SECUNIA-60974 (http://secunia.com/advisories/60974)

20140718 KL-001-2014-002 : Microsoft XP SP3 BthPan.sys Arbitrary Write Privilege Escalation (http://seclists.org/fulldisclosure/2014/Jul/96)

Miscellaneous

https://www.korelogic.com/Resources/Advisories/KL-001-2014-002.txt

http://packetstormsecurity.com/files/127536/Microsoft-XP-SP3-MQAC.sys-Arbitrary-Write-Privilege-Escalation.html

https://www.korelogic.com/Resources/Advisories/KL-001-2014-003.txt

http://packetstormsecurity.com/files/127535/Microsoft-XP-SP3-BthPan.sys-Arbitrary-Write-Privilege-Escalation.html

http://packetstormsecurity.com/files/128674/Microsoft-Bluetooth-Personal-Area-Networking-BthPan.sys-Privilege-Escalation.html

Rapid7

Technical Analysis