CERT-In Vulnerability Note
CIVN-2014-0253
Microsoft .NET Framework Elevation of Privilege Vulnerability
Original Issue Date:November 12, 2014
Severity Rating: HIGH
Systems Affected
- Windows Server 2003 Service Pack 2
- Windows Server 2003 x64 Edition Service Pack 2
- Windows Server 2003 with Service Pack 2 for Itanium-based Systems
- Windows Vista Service Pack 2
- Windows Vista x64 Edition Service Pack 2
- Windows Server 2008 for 32-bit Systems Service Pack 2
- Windows Server 2008 for x64-based Systems Service Pack 2
- Windows Server 2008 for Itanium-based Systems Service Pack 2
- Windows 7 for 32-bit Systems Service Pack 1
- Windows 7 for x64-based Systems Service Pack 1
- Windows Server 2008 R2 for x64-based Systems Service Pack 1
- Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
- Windows 8 for 32-bit Systems
- Windows 8 for x64-based Systems
- Windows 8.1 for 32-bit Systems
- Windows Server 2012 and R2
- Windows RT and 8.1
- Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
- Windows Server 2012 (Server Core installation)
- Windows Server 2012 R2 (Server Core installation)
Component Affected
- Microsoft .NET Framework 1.1 Service Pack 1
- Microsoft .NET Framework 2.0 Service Pack 2
- Microsoft .NET Framework 3.5
- Microsoft .NET Framework 3.5.1
- Microsoft .NET Framework 4,
- Microsoft .NET Framework 4.5
- Microsoft .NET Framework 4.5.1
- Microsoft .NET Framework 4.5.2
Overview
A vulnerability has been reported in Microsoft .NET Framework which could allow a remote attacker to gain elevated privileges leading to complete system compromise.
Description
This vulnerability exist due to improper handling of TypeFilterLevel checks for malformed objects by the Microsoft .NET Framework.
A remote attacker could exploit this vulnerability by sending crafted content to a targeted system that uses ".NET Remoting" to execute arbitrary code on the system with elevated privileges, which could result in a complete system compromise.
Workaround
- Enable security when registering a channel.
- Block outgoing traffic from the Remoting endpoint at the firewall level.
Solution
Apply appropriate patch as mention in Microsoft Security Bulletin
MS14-072
Vendor Information
Microsoft
https://technet.microsoft.com/library/security/ms14-072
References
Microsoft
https://technet.microsoft.com/library/security/ms14-072
CISCO
http://tools.cisco.com/security/center/viewAlert.x?alertId=36279
Security Focus
http://www.securityfocus.com/bid/70979
CVE Name
CVE-2014-4149
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|