CVE-2014-0322

Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.

CVSS v3 8.8 HIGH
CVSS v2.0 9.3 HIGH

8.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://community.websense.com/blogs/securitylabs/archive/2014/02/13/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx	Broken Link Permissions Required
http://technet.microsoft.com/security/advisory/2934088	Patch Vendor Advisory
http://twitter.com/nanoc0re/statuses/434251658344673281	Press/Media Coverage
http://www.exploit-db.com/exploits/32851	Exploit Third Party Advisory VDB Entry
http://www.exploit-db.com/exploits/32904	Exploit Third Party Advisory VDB Entry
http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2.html	Broken Link
http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html	Broken Link
http://www.kb.cert.org/vuls/id/732479	Third Party Advisory US Government Resource
http://www.osvdb.org/103354	Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012	Patch Vendor Advisory
https://www.dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip	Broken Link Exploit
http://community.websense.com/blogs/securitylabs/archive/2014/02/13/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx	Broken Link Permissions Required
http://technet.microsoft.com/security/advisory/2934088	Patch Vendor Advisory
http://twitter.com/nanoc0re/statuses/434251658344673281	Press/Media Coverage
http://www.exploit-db.com/exploits/32851	Exploit Third Party Advisory VDB Entry
http://www.exploit-db.com/exploits/32904	Exploit Third Party Advisory VDB Entry
http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2.html	Broken Link
http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html	Broken Link
http://www.kb.cert.org/vuls/id/732479	Third Party Advisory US Government Resource
http://www.osvdb.org/103354	Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012	Patch Vendor Advisory
https://www.dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip	Broken Link Exploit

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_7:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2008:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2008:r2:::::::*
	cpe:2.3:o:microsoft:windows_vista:-:::::::*

Configuration 2 (hide)

AND

cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_7:-:::::::*
	cpe:2.3:o:microsoft:windows_8:-:::::::*
	cpe:2.3:o:microsoft:windows_rt:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2008:r2:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*

History

21 Nov 2024, 02:01

Type	Values Removed	Values Added
References	~~() http://community.websense.com/blogs/securitylabs/archive/2014/02/13/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx - Broken Link, Permissions Required~~	() http://community.websense.com/blogs/securitylabs/archive/2014/02/13/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx - Broken Link, Permissions Required
References	~~() http://technet.microsoft.com/security/advisory/2934088 - Patch, Vendor Advisory~~	() http://technet.microsoft.com/security/advisory/2934088 - Patch, Vendor Advisory
References	~~() http://twitter.com/nanoc0re/statuses/434251658344673281 - Press/Media Coverage~~	() http://twitter.com/nanoc0re/statuses/434251658344673281 - Press/Media Coverage
References	~~() http://www.exploit-db.com/exploits/32851 - Exploit, Third Party Advisory, VDB Entry~~	() http://www.exploit-db.com/exploits/32851 - Exploit, Third Party Advisory, VDB Entry
References	~~() http://www.exploit-db.com/exploits/32904 - Exploit, Third Party Advisory, VDB Entry~~	() http://www.exploit-db.com/exploits/32904 - Exploit, Third Party Advisory, VDB Entry
References	~~() http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2.html - Broken Link~~	() http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/new-ie-zero-day-found-in-watering-hole-attack-2.html - Broken Link
References	~~() http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html - Broken Link~~	() http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html - Broken Link
References	~~() http://www.kb.cert.org/vuls/id/732479 - Third Party Advisory, US Government Resource~~	() http://www.kb.cert.org/vuls/id/732479 - Third Party Advisory, US Government Resource
References	~~() http://www.osvdb.org/103354 - Broken Link~~	() http://www.osvdb.org/103354 - Broken Link
References	~~() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012 - Patch, Vendor Advisory~~	() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012 - Patch, Vendor Advisory
References	~~() https://www.dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip - Broken Link, Exploit~~	() https://www.dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip - Broken Link, Exploit

02 Jul 2024, 16:50

Type	Values Removed	Values Added
CPE		cpe:2.3:o:microsoft:windows_7:-:::::::* cpe:2.3:o:microsoft:windows_8:-:::::::* cpe:2.3:o:microsoft:windows_server_2008:-:::::::* cpe:2.3:o:microsoft:windows_server_2008:r2:::::::* cpe:2.3:o:microsoft:windows_vista:-:::::::* cpe:2.3:o:microsoft:windows_server_2012:-:::::::* cpe:2.3:o:microsoft:windows_rt:-:::::::*
First Time		Microsoft windows Rt Microsoft windows Server 2012 Microsoft windows Vista Microsoft windows 8 Microsoft windows Server 2008 Microsoft windows 7
CVSS	v2 : ~~9.3~~ v3 : ~~unknown~~	v2 : 9.3 v3 : 8.8
References	~~() http://community.websense.com/blogs/securitylabs/archive/2014/02/13/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx - Permissions Required~~	() http://community.websense.com/blogs/securitylabs/archive/2014/02/13/msie-0-day-exploit-cve-2014-0322-possibly-targeting-french-aerospace-organization.aspx - Broken Link, Permissions Required
References	~~() http://technet.microsoft.com/security/advisory/2934088 - Mitigation, Patch, Vendor Advisory~~	() http://technet.microsoft.com/security/advisory/2934088 - Patch, Vendor Advisory
References	~~() http://www.exploit-db.com/exploits/32851 - Exploit~~	() http://www.exploit-db.com/exploits/32851 - Exploit, Third Party Advisory, VDB Entry
References	~~() http://www.exploit-db.com/exploits/32904 - Exploit~~	() http://www.exploit-db.com/exploits/32904 - Exploit, Third Party Advisory, VDB Entry
References	~~() http://www.osvdb.org/103354 -~~	() http://www.osvdb.org/103354 - Broken Link
References	~~() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012 -~~	() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012 - Patch, Vendor Advisory
References	~~() https://www.dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip - Exploit~~	() https://www.dropbox.com/s/pyxjgycmudirbqe/CVE-2014-0322.zip - Broken Link, Exploit

Information

Published : 2014-02-14 16:55

Updated : 2024-11-21 02:01

NVD link : CVE-2014-0322

Mitre link : CVE-2014-0322

CVE.ORG link : CVE-2014-0322

JSON object : View

Products Affected

microsoft

windows_vista
windows_rt
windows_7
windows_server_2012
windows_server_2008
internet_explorer
windows_8

CWE

CWE-416

Use After Free

8.8 /10