CVE-2014-4073 Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 processes unverified data during interaction with the ClickOnce installer, which allows remote attackers to gain privileges via v...
HighCVSS 10.0
EPSS 23.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 processes unverified data during interaction with the ClickOnce installer, which allows remote attackers to gain privileges via vectors involving Internet Explorer, aka ".NET ClickOnce Elevation of Privilege Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft net framework | = 2.0-sp2 | No fix listed |
| Microsoft net framework | = 3.5 | No fix listed |
| Microsoft net framework | = 3.5.1 | No fix listed |
| Microsoft net framework | = 4.0 | No fix listed |
| Microsoft net framework | = 4.5 | No fix listed |
| Microsoft net framework | = 4.5.1 | No fix listed |
| Microsoft net framework | = 4.5.2 | No fix listed |
References
- blogs.technet.com vendor-advisory
- 60969 third-party-advisory
- 70313 vdb-entry
- 1031021 vdb-entry
- MS14-057 vendor-advisory