CVE-2014-4971 Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a craf...
HighCVSS 7.2
EPSS 23.0%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows xp | All versions | No fix listed |
References
- blogs.technet.com vendor-advisory
- packetstormsecurity.com
- packetstormsecurity.com
- packetstormsecurity.com exploit vdb-entry
- 20140718 KL-001-2014-002 : Microsoft XP SP3 BthPan.sys Arbitrary Write Privilege Escalation exploit mailing-list
- 20140718 KL-001-2014-003 : Microsoft XP SP3 MQAC.sys Arbitrary Write Privilege Escalation exploit mailing-list
- 60974 permissions-required third-party-advisory
- 34112 exploit
- 34131 exploit
- 34982 exploit
- 109387 broken-link vdb-entry
- 20140718 KL-001-2014-002 : Microsoft XP SP3 BthPan.sys Arbitrary Write Privilege Escalation mailing-list
- 20140718 KL-001-2014-003 : Microsoft XP SP3 MQAC.sys Arbitrary Write Privilege Escalation mailing-list
- 68764 vdb-entry
- 1031025 third-party-advisory vdb-entry
- MS14-062 vendor-advisory
- www.korelogic.com exploit
- www.korelogic.com exploit