CVE-2014-8174
published 2017-09-19CVE-2014-8174: eDeploy makes it easier for remote attackers to execute arbitrary code by leveraging use of HTTP to download files.
PriorityP353critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
3.01%
85.9th percentile
eDeploy makes it easier for remote attackers to execute arbitrary code by leveraging use of HTTP to download files.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | edeploy | <= 1.11.0 | — |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-8174 eDeploy enovance: use of HTTP to download sensitive files
bugzilla·2015-03-17·CVSS 9.8
CVE-2014-8174 [CRITICAL] CVE-2014-8174 eDeploy enovance: use of HTTP to download sensitive files
CVE-2014-8174 eDeploy enovance: use of HTTP to download sensitive files
Kurt Seifried of Red Hat reports:
edeploy uses HTTP to download a large number of sensitive files which can lead to code execution:
./ansible/edeploy-install.yml: value=http://{{ ansible_default_ipv4["address"] }}/
./build/base.install: echo "Acquire { Retries \"0\"; HTTP { Proxy \"http://${HTTP_PROXY}\"; }; };" >> "$target/etc/apt/apt.conf.d/01proxy"
./build/base.install: curl -o ${target}/tmp/tar.deb http://ftp.debian.org/debian/pool/main/t/tar/tar_1.27.1-1~bpo70+1_${ARCH:=amd64}.deb
./build/base.install: echo "deb http://security.ubuntu.com/ubuntu $dist-security main universe multiverse" >> ${target}/etc/apt/sources.list
./build/base.install: echo "deb http://security.debian.org/ $dist/updates main" > ${target}/
Securelist
Delving deep into VBScript
blogs_securelist·2018-07-03·CVSS 8.8
CVE-2018-8174 [HIGH] Delving deep into VBScript
Authors
- Boris Larin
## Analysis of CVE-2018-8174 exploitation
In late April we found and wrote a description of CVE-2018-8174, a new zero-day vulnerability for Internet Explorer that was picked up by our sandbox. The vulnerability uses a well-known technique from the proof-of-concept exploit CVE-2014-6332 that essentially “corrupts” two memory objects and changes the type of one object to Array (for read/write access to the address space) and the other object to Integer to fetch the address of an arbitrary object.
But whereas CVE-2014-6332 was aimed at integer overflow exploitation for writing to arbitrary memory locations, my interest lay in how this technique was adapted to exploit the use-after-free vulnerability. To answer this question, let’s consider the internal structure of t
2017-09-19
Published