CVE-2014-0257

EPSS 69.8%

Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute a method, which allows remote attackers to execute arbitrary code via (1) a crafted web site or (2) a crafted .NET Framework application that exposes a COM server endpoint, aka "Type Traversal Vulnerability."

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.com/files/127246/MS14-009-.NET-Deployment-Service-IE-Sandbox-Escape.htmlunverified cve_referencewww.exploit-db.com/exploits/33892unverified exploitdbwww.exploit-db.com/exploits/33892unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/127246/MS14-009-.NET-Deployment-Service-IE-Sandbox-Escape.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-009 http://secunia.com/advisories/56793 http://www.exploit-db.com/exploits/33892 http://www.osvdb.org/103163 http://www.securityfocus.com/bid/65417 http://www.securitytracker.com/id/1029745