CVE-2014-4149

{"id": "CVE-2014-4149", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-11-11T22:55:04.857", "references": [{"url": "http://blogs.technet.com/b/srd/archive/2014/11/11/ms14-072-net-remoting-elevation-of-privilege-vulnerability.aspx", "tags": ["Vendor Advisory"], "source": "secure@microsoft.com"}, {"url": "http://www.securitytracker.com/id/1031188", "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-072", "source": "secure@microsoft.com"}, {"url": "http://blogs.technet.com/b/srd/archive/2014/11/11/ms14-072-net-remoting-elevation-of-privilege-vulnerability.aspx", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1031188", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-072", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly perform TypeFilterLevel checks, which allows remote attackers to execute arbitrary code via crafted data to a .NET Remoting endpoint, aka \"TypeFilterLevel Vulnerability.\""}, {"lang": "es", "value": "Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, y 4.5.2 no realiza debidamente las comprobaciones TypeFilterLevel, lo que permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de datos manipulados en un endpoint .NET Remoting, tambi\u00e9n conocido como 'vulnerabilidad de TypeFilterLevel.'"}], "lastModified": "2024-11-21T02:09:35.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0BF6AE15-EAC3-4100-A742-211026C79CCC"}, {"criteria": "cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "42A6DF09-B8E1-414D-97E7-453566055279"}, {"criteria": "cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E039CE1F-B988-4741-AE2E-5B36E2AF9688"}, {"criteria": "cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8EDC4407-7E92-4E60-82F0-0C87D1860D3A"}, {"criteria": "cpe:2.3:a:microsoft:.net_framework:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "792B417F-96A0-4E9D-9E79-5D7F982E2225"}, {"criteria": "cpe:2.3:a:microsoft:.net_framework:4.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61FAD9EE-FA7F-4B39-8A9B-AFFAEC8BF214"}, {"criteria": "cpe:2.3:a:microsoft:.net_framework:4.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "299DBEAE-1829-47A9-B09E-4AF327831B69"}, {"criteria": "cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40B3A045-B08A-44E0-91BE-726753F6A362"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}