CVE-2014-4078

The IP Security feature in Microsoft Internet Information Services (IIS) 8.0 and 8.5 does not properly process wildcard allow and deny rules for domains within the "IP Address and Domain Restrictions" list, which makes it easier for remote attackers to bypass an intended rule set via an HTTP request, aka "IIS Security Feature Bypass Vulnerability."

CVSS v2.0 5.1 MEDIUM

5.1^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:H/Au:N/C:P/I:P/A:P

Exploitability : 4.9 / Impact : 6.4

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/70937
http://www.securitytracker.com/id/1031194
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-076

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:internet_information_services:8.0:::::::*
	cpe:2.3:a:microsoft:internet_information_services:8.5:::::::*

History

No history.

Information

Published : 2014-11-11 22:55

Updated : 2024-02-28 12:20

NVD link : CVE-2014-4078

Mitre link : CVE-2014-4078

CVE.ORG link : CVE-2014-4078

JSON object : View

Products Affected

microsoft

internet_information_services

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2014-4078", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-11-11T22:55:04.670", "references": [{"url": "http://www.securityfocus.com/bid/70937", "source": "secure@microsoft.com"}, {"url": "http://www.securitytracker.com/id/1031194", "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-076", "source": "secure@microsoft.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The IP Security feature in Microsoft Internet Information Services (IIS) 8.0 and 8.5 does not properly process wildcard allow and deny rules for domains within the \"IP Address and Domain Restrictions\" list, which makes it easier for remote attackers to bypass an intended rule set via an HTTP request, aka \"IIS Security Feature Bypass Vulnerability.\""}, {"lang": "es", "value": "La caracteristica de seguridad IP en Microsoft Internet Information Services (IIS) 8.0 y 8.5 no procesa debidamente el permitir comod\u00edn y negar las normas para dominios dentro de la lista 'Restricciones de Direcciones IP y Dominios', lo que facilita a atacantes remotos evadir un juego de normas a trav\u00e9s de una solicitud HTTP, tambi\u00e9n conocido como 'vulnerabilidad de de la evasi\u00f3n de la caracteristica de seguridad en IIS.'"}], "lastModified": "2018-10-12T22:07:01.317", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:internet_information_services:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BAC6BBBD-62A6-4AE7-B758-2E396FB05220"}, {"criteria": "cpe:2.3:a:microsoft:internet_information_services:8.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "52F8EE81-EE21-45EA-B000-FD9F57497D51"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}