CVE-2014-0257
published 2014-02-12CVE-2014-0257: Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute a method, which…
PriorityP275critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
69.80%
99.3th percentile
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute a method, which allows remote attackers to execute arbitrary code via (1) a crafted web site or (2) a crafted .NET Framework application that exposes a COM server endpoint, aka "Type Traversal Vulnerability."
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for dfsvc.exe (.NET Deployment Service) spawned from or interacting with iexplore.exe at Low Integrity level, which is indicative of an IE Enhanced Protected Mode sandbox escape attempt. ↗
- →Detect the environment variable PSHCMD being set within an iexplore.exe process context, as the exploit stages a PowerShell payload via this variable. ↗
- →Alert on CVE-2014-0257.dll being written to the %TEMP% directory and subsequently loaded, as this is the exploit's dropped library artifact. ↗
- ·The exploit only targets .NET 4.5 and .NET 4.5.1 deployments; other .NET versions are not covered by this specific Metasploit module even though the CVE affects .NET 1.0 through 4.5.1. ↗
- ·The module targets IE 8 through IE 11 exclusively. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Project0
Windows Bug Class: Accessing Trapped COM Objects with IDispatch - Project Zero
project_zero·2025-01-01·CVSS 7.8
CVE-2014-0257 [HIGH] Windows Bug Class: Accessing Trapped COM Objects with IDispatch - Project Zero
Posted by James Forshaw, Google Project Zero
Object orientated remoting technologies such as DCOM and .NET Remoting make it very easy to develop an object-orientated interface to a service which can cross process and security boundaries. This is because they're designed to support a wide range of objects, not just those implemented in the service, but any other object compatible with being remoted. For example, if you wanted to expose an XML document across the client-server boundary, you could use a pre-existing COM or .NET library and return that object back to the client. By default when the object is returned it's marshaled by reference, which results in the object staying in the out-of-process server.
This flexibility has a number of downsides, one of which is the topic of t
GHSA
GHSA-x4qf-4j36-qp5x: Microsoft
ghsa_unreviewed·2022-05-14
CVE-2014-0257 [HIGH] CWE-20 GHSA-x4qf-4j36-qp5x: Microsoft
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute a method, which allows remote attackers to execute arbitrary code via (1) a crafted web site or (2) a crafted .NET Framework application that exposes a COM server endpoint, aka "Type Traversal Vulnerability."
Project0
Exploiting .NET Managed DCOM - Project Zero
project_zero·2017-04-01
CVE-2014-0257 Exploiting .NET Managed DCOM - Project Zero
Posted by James Forshaw, Project Zero
One of the more interesting classes of security vulnerabilities are those affecting interoperability technology. This is because these vulnerabilities typically affect any application using the technology, regardless of what the application actually does. Also in many cases they’re difficult for a developer to mitigate outside of not using that technology, something which isn’t always possible.
I discovered one such vulnerability class in the Component Object Model (COM) interoperability layers of .NET which make the use of .NET for Distributed COM (DCOM) across privilege boundaries inherently insecure. This blog post will describe a couple of ways this could be abused, first to gain elevated privileges and then as a remote code execution vulnerabi
No detection rules found.
Exploit-DB
Microsoft .NET Deployment Service - IE Sandbox Escape (MS14-009) (Metasploit)
exploitdb·2014-06-27
CVE-2014-0257 Microsoft .NET Deployment Service - IE Sandbox Escape (MS14-009) (Metasploit)
Microsoft .NET Deployment Service - IE Sandbox Escape (MS14-009) (Metasploit)
---
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
require 'rex'
require 'msf/core/exploit/exe'
require 'msf/core/exploit/powershell'
class Metasploit3 {
'dfsvc' => '4.0.30319.17929.17',
'mscorlib' => '4.0.30319.18063.18'
},
'4.5.1' => {
'dfsvc' => '4.0.30319.18408.18',
'mscorlib' => '4.0.30319.18444.18'
}
}
def initialize(info={})
super( update_info( info,
'Name' => 'MS14-009 .NET Deployment Service IE Sandbox Escape',
'Description' => %q{
This module abuses a process creation policy in the Internet Explorer Sandbox which allows
to escape the Enhanced Protected Mode and execute code with Medium Integr
Metasploit
MS14-009 .NET Deployment Service IE Sandbox Escape
metasploit
MS14-009 .NET Deployment Service IE Sandbox Escape
MS14-009 .NET Deployment Service IE Sandbox Escape
This module abuses a process creation policy in Internet Explorer's sandbox, specifically in the .NET Deployment Service (dfsvc.exe), which allows the attacker to escape the Enhanced Protected Mode, and execute code with Medium Integrity.
Talos
Microsoft Update Tuesday: February 2014, huge fix for Internet Explorer
blogs_talos·2014-02-11·CVSS 9.3
[CRITICAL] Microsoft Update Tuesday: February 2014, huge fix for Internet Explorer
The Microsoft Updates are pretty significant this month. Internet Explorer, which was missing from the updates for the first time in a long time last month is back with a whopping 24 vulnerabilities. Besides the IE bulletin, there’s six more bulletins, 4 of which are rated critical and 3 of which are rated important. All-in-all, this Update Tuesday provides fixes for 32 CVEs. The list of bulletins below is ordered by rating rather than number (i.e., the same ordering as used here: https://technet.microsoft.com/en-us/security/bulletin/ms14-feb).
The first bulletin, MS14-010, deals with IE and is rated critical and provides fixes for 24 CVEs. As is usual, most of the vulnerabilities are the result of use-after-free vulnerabilities. Most of the vulnerabilities were reported privately to Micr
Talos
Microsoft Update Tuesday: February 2014, huge fix for Internet Explorer
blogs_talos·2014-02-11·CVSS 9.3
[CRITICAL] Microsoft Update Tuesday: February 2014, huge fix for Internet Explorer
## Microsoft Update Tuesday: February 2014, huge fix for Internet Explorer
The Microsoft Updates are pretty significant this month. Internet Explorer, which was missing from the updates for the first time in a long time last month is back with a whopping 24 vulnerabilities. Besides the IE bulletin, there’s six more bulletins, 4 of which are rated critical and 3 of which are rated important. All-in-all, this Update Tuesday provides fixes for 32 CVEs. The list of bulletins below is ordered by rating rather than number (i.e., the same ordering as used here: https://technet.microsoft.com/en-us/security/bulletin/ms14-feb).
The first bulletin, MS14-010 , deals with IE and is rated critical and provides fixes for 24 CVEs. As is usual, most of the vulnerabilities are the result of use-after-free
http://packetstormsecurity.com/files/127246/MS14-009-.NET-Deployment-Service-IE-Sandbox-Escape.htmlhttp://secunia.com/advisories/56793http://www.exploit-db.com/exploits/33892http://www.osvdb.org/103163http://www.securityfocus.com/bid/65417http://www.securitytracker.com/id/1029745https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-009http://packetstormsecurity.com/files/127246/MS14-009-.NET-Deployment-Service-IE-Sandbox-Escape.htmlhttp://secunia.com/advisories/56793http://www.exploit-db.com/exploits/33892http://www.osvdb.org/103163http://www.securityfocus.com/bid/65417http://www.securitytracker.com/id/1029745https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-009
2014-02-12
Published