CVE-2014-4971
HIGH 7.2EPSS 23.0%
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.
- CVSS v2.0 NVD
- 7.2 HIGH
AV:L/AC:L/Au:N/C:C/I:C/A:C - EPSS
- 23.05% chance of exploitation in the next 30 days, 98th percentile
- Published
- 2014-07-26
- Updated
- 2024-08-06
Proof-of-concept exploits (5)
- http://seclists.org/fulldisclosure/2014/Jul/96
- http://seclists.org/fulldisclosure/2014/Jul/97
- http://www.exploit-db.com/exploits/34112
- http://www.exploit-db.com/exploits/34131
- http://www.exploit-db.com/exploits/34982
Metasploit modules (2)
- rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/bthpan.rb
- rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/mqac_write.rb
ExploitDB entries (4)
- https://www.exploit-db.com/exploits/34982
- https://www.exploit-db.com/exploits/34167
- https://www.exploit-db.com/exploits/34131
- https://www.exploit-db.com/exploits/34112
Security advisories
- http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-sec…
- http://www.securitytracker.com/id/1031025
- http://www.securityfocus.com/bid/68764
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-062