CVE-2014-4073
published 2014-10-15CVE-2014-4073: Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 processes unverified data during interaction with the ClickOnce installer, which allows…
PriorityP263critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
23.43%
97.6th percentile
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 processes unverified data during interaction with the ClickOnce installer, which allows remote attackers to gain privileges via vectors involving Internet Explorer, aka ".NET ClickOnce Elevation of Privilege Vulnerability."
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for replacement of the WMI service binary (winmgmt) via sc.exe config with a non-standard binPath, which is a key step in the FakeWMIServer attack chain. ↗
- →Detect inbound/outbound firewall rules being created for unknown executables in non-standard paths (e.g., c:\service\) using New-NetFirewallRule, which is used to expose the fake WMI service. ↗
- →Alert on .NET DCOM clients (System.Management / Get-WmiObject) connecting to remote WMI endpoints where the initial CreateInstance call uses only CONNECT level authentication, which enables MITM/Man-At-The-Side attacks delivering malicious BinaryFormatter streams. ↗
- →Detect IManagedObject interface queries on IWbemServices objects returned from IWbemLevel1Login::NTLMLogin, which triggers automatic deserialization of an untrusted BinaryFormatter stream on the client. ↗
- →Alert on unexpected child processes (e.g., cmd.exe, notepad.exe) spawned in the context of a privileged monitoring account following Get-WmiObject or System.Management DCOM calls to remote hosts. ↗
- ·The DAX2API privilege escalation is specific to systems with Realtek Audio Driver version 6.0.1.7898 on Windows 10 (tested on Lenovo P50); service binary version 0.7.2.61 built 7/18/2016. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h6h5-h2pp-h9f3: Microsoft
ghsa_unreviewed·2022-05-14
CVE-2014-4073 [HIGH] GHSA-h6h5-h2pp-h9f3: Microsoft
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 processes unverified data during interaction with the ClickOnce installer, which allows remote attackers to gain privileges via vectors involving Internet Explorer, aka ".NET ClickOnce Elevation of Privilege Vulnerability."
Project0
Exploiting .NET Managed DCOM - Project Zero
project_zero·2017-04-01
CVE-2014-0257 Exploiting .NET Managed DCOM - Project Zero
Posted by James Forshaw, Project Zero
One of the more interesting classes of security vulnerabilities are those affecting interoperability technology. This is because these vulnerabilities typically affect any application using the technology, regardless of what the application actually does. Also in many cases they’re difficult for a developer to mitigate outside of not using that technology, something which isn’t always possible.
I discovered one such vulnerability class in the Component Object Model (COM) interoperability layers of .NET which make the use of .NET for Distributed COM (DCOM) across privilege boundaries inherently insecure. This blog post will describe a couple of ways this could be abused, first to gain elevated privileges and then as a remote code execution vulnerabi
No detection rules found.
Exploit-DB
Microsoft Windows 10 - COM Desktop Broker Privilege Escalation
exploitdb·2019-01-14
CVE-2019-0552 Microsoft Windows 10 - COM Desktop Broker Privilege Escalation
Microsoft Windows 10 - COM Desktop Broker Privilege Escalation
---
Windows: COM Desktop Broker Elevation of Privilege
Platform: Windows 10 1809 (almost certainly earlier versions as well).
Class: Elevation of Privilege
Security Boundary (per Windows Security Service Criteria): AppContainer Sandbox
Summary:
The COM Desktop Broker doesn’t correctly check permissions resulting in elevation of privilege and sandbox escape.
Description:
Windows 10 introduced “Brokered Windows Runtime Components for side-loaded applications” which allows a UWP application to interact with privileged components by allowing developers to write a custom broker in .NET. Rather than handling this with the existing Runtime Broker a new “Desktop Broker” was created and plumbed into the COM infrastructure. This req
Exploit-DB
Realtek Audio Driver 6.0.1.7898 (Windows 10) - Dolby Audio X2 Service Privilege Escalation
exploitdb·2017-04-25
CVE-2017-7293 Realtek Audio Driver 6.0.1.7898 (Windows 10) - Dolby Audio X2 Service Privilege Escalation
Realtek Audio Driver 6.0.1.7898 (Windows 10) - Dolby Audio X2 Service Privilege Escalation
---
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1075
Windows: Dolby Audio X2 Service Elevation of Privilege
Platform: Windows 10 + Realtek Audio Driver version 6.0.1.7898 (on a Lenovo P50). Version of the service binary 0.7.2.61 built on 7/18/2016.
Class: Elevation of Privilege
Summary:
The DAX2API service installed as part of the Realtek Audio Driver on Windows 10 is vulnerable to a privilege escalation vulnerability which allows a normal user to get arbitrary system privileges.
Description:
The DAX2API service is a DCOM service written in .NET running at system privileges. The use of .NET for DCOM is inherently unsafe and should not be used. There’s public exploit code t
Exploit-DB
Microsoft Windows - ManagementObject Arbitrary .NET Serialization Remote Code Execution
exploitdb·2017-04-20
CVE-2017-0160 Microsoft Windows - ManagementObject Arbitrary .NET Serialization Remote Code Execution
Microsoft Windows - ManagementObject Arbitrary .NET Serialization Remote Code Execution
---
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1081
Windows: ManagementObject Arbitrary .NET Serialization RCE
Platform: .NET 4.6, Powershell 4. Tested between Server 2016 and Windows 10 Anniversary Edition
Class: Remote Code Execution
Summary:
Accessing a compromised WMI server over DCOM using System.Management classes or the Powershell Get-WmiObject Cmdlet can lead to the server running arbitrary code on the calling machine leading to RCE.
Description:
The dangers of using .NET for DCOM are well know, the SRD blog made a post (https://blogs.technet.microsoft.com/srd/2014/10/14/more-details-about-cve-2014-4073-elevation-of-privilege-vulnerability/) which explicitly said it
No writeups or analysis indexed.
http://blogs.technet.com/b/srd/archive/2014/10/14/more-details-about-cve-2014-4073-elevation-of-privilege-vulnerability.aspxhttp://secunia.com/advisories/60969http://www.securityfocus.com/bid/70313http://www.securitytracker.com/id/1031021https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-057http://blogs.technet.com/b/srd/archive/2014/10/14/more-details-about-cve-2014-4073-elevation-of-privilege-vulnerability.aspxhttp://secunia.com/advisories/60969http://www.securityfocus.com/bid/70313http://www.securitytracker.com/id/1031021https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-057
2014-10-15
Published