CVE-2014-4971

HIGH 7.2CVE-2014-4971 · Published 26/07/2014 · updated 17/06/2026

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.

References

blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx · Vendor Advisory
packetstormsecurity.com/files/127535/Microsoft-XP-SP3-BthPan.sys-Arbitrary-Write-Privilege-Escalation.html
packetstormsecurity.com/files/127536/Microsoft-XP-SP3-MQAC.sys-Arbitrary-Write-Privilege-Escalation.html
packetstormsecurity.com/files/128674/Microsoft-Bluetooth-Personal-Area-Networking-BthPan.sys-Privilege-Escalation.html · Exploit
seclists.org/fulldisclosure/2014/Jul/96 · Exploit
seclists.org/fulldisclosure/2014/Jul/97 · Exploit
secunia.com/advisories/60974 · Permissions Required
exploit-db.com/exploits/34112 · Exploit
exploit-db.com/exploits/34131
exploit-db.com/exploits/34982 · Exploit
osvdb.org/109387 · Broken Link
securityfocus.com/archive/1/532843/100/0/threaded
securityfocus.com/archive/1/532844/100/0/threaded
securityfocus.com/bid/68764
securitytracker.com/id/1031025 · Third Party Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-062
korelogic.com/Resources/Advisories/KL-001-2014-002.txt · Exploit
korelogic.com/Resources/Advisories/KL-001-2014-003.txt · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free