Unscored severity · published Jul 26, 2014
CVE-2014-4971
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain…
–
CVSS
23%
EPSS
No
On KEV
Description
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.
Exploitation
Is it being used?
Exploit prediction (EPSS)23.0% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WX
Windows XP · Microsoft
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-4971
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-4971
Vendor Advisory
http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx
packetstormsecurity.com
http://packetstormsecurity.com/files/127535/Microsoft-XP-SP3-BthPan.sys-Arbitrary-Write-Privilege-Escalation.html
packetstormsecurity.com
http://packetstormsecurity.com/files/127536/Microsoft-XP-SP3-MQAC.sys-Arbitrary-Write-Privilege-Escalation.html
Exploit
http://packetstormsecurity.com/files/128674/Microsoft-Bluetooth-Personal-Area-Networking-BthPan.sys-Privilege-Escalation.html
Exploit
http://seclists.org/fulldisclosure/2014/Jul/96
Exploit
http://seclists.org/fulldisclosure/2014/Jul/97
More from Windows XP
9.8
CVE-2008-4250
Microsoft Windows Buffer Overflow Vulnerability
8.8
CVE-2013-3918
Microsoft Windows Out-of-Bounds Write Vulnerability
8.8
CVE-2011-3402
Microsoft Windows Remote Code Execution Vulnerability
8.8
CVE-2008-0015
Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability
8.8
CVE-2009-1537
Microsoft DirectX NULL Byte Overwrite Vulnerability