CERT-In Vulnerability Note
CIVN-2014-0249
Remote Code Execution Vulnerability in Microsoft XML Core Services
Original Issue Date:November 12, 2014
Severity Rating: HIGH
Systems Affected
- Microsoft Server 2003 SP2
- Microsoft Server 2003 x64 Edition SP2
- Microsoft Server 2003 Itanium-based Systems SP2
- Windows Vista SP2
- Windows Vista x64 Edition SP2
- Microsoft Server 2008 32-bit Systems SP2
- Microsoft Server 2008 x64-based Systems SP2
- Microsoft Server 2008 Itanium-based Systems SP2
- Windows 7 32-bit Systems SP1
- Windows 7 x64-based Systems SP1
- Microsoft Server 2008 R2 x64-based Systems SP1
- Microsoft Server 2008 R2 Itanium-based Systems SP1
- Windows 8 32-bit Systems
- Windows 8 x64-based Systems
- Windows 8.1 32-bit Systems
- Windows 8.1 x64-based Systems
- Windows Server 2012
- Windows Server 2012 R2
- Windows RT
- Windows RT 8.1
Component Affected
- Microsoft XML Core Services 3.0
Overview
A vulnerability has been reported in Microsoft XML Core Services (MSXML) which could be exploited by a remote attacker to execute remote code on the targeted system in the context of the current user.
Description
Microsoft XML Core Services (MSXML) provides a set of services for applications written in JScript, VBScript and Microsoft Visual Studio tools to develop XML-based applications that provide interoperability with the applications that uses XML 1.0 standard.
Remote code execution vulnerability exists in Microsoft XML Core Services due to improper parsing of XML Content. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to view a specially crafted document or webpage. Processing of the file could corrupt system state which could allow an attacker to execute arbitrary code on the affected system using logged-in user privileges.Successful exploitation could result in system compromise.
Workaround
- Prevent MSXML 3.0 binary behaviors from being used in Internet Explorer Solution
Solution
Apply appropriate updates as mentioned in the Microsoft Security Bulletin
MS14-067
Vendor Information
Microsoft
https://technet.microsoft.com/en-us/library/security/ms14-067.aspx
References
CISCO
http://tools.cisco.com/security/center/viewAlert.x?alertId=36326
Security Focus
http://www.securityfocus.com/bid/70957/info
Microsoft
https://technet.microsoft.com/en-us/library/security/ms14-067.aspx
CVE Name
CVE-2014-4118
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|