Vulnerability CVE-2014-1767

Vulnerability CVE-2014-1767

Published: 2014-07-08 Modified: 2014-07-09

Description:

Double free vulnerability in the Ancillary Function Driver (AFD) in afd.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."

See advisories in our WLB2 database:

	Topic	Author	Date
High	Microsoft Windows - AFD.SYS Dangling Pointer Privilege Escalation MS14-040	Rick Larabee	16.02.2016
High	Microsoft Windows AFD.SYS Privilege Escalation (MS14-040) Exploit	Rick Larabee	07.03.2016

Type:

CWE-415

(Double Free)

CVSS2 => (AV:L/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score	Impact Subscore	Exploitability Subscore
7.2/10	10/10	3.9/10

Exploit range	Attack complexity	Authentication
Local	Low	No required
Confidentiality impact	Integrity impact	Availability impact
Complete	Complete	Complete

Affected software
Microsoft -> Windows 7
Microsoft -> Windows 8
Microsoft -> Windows 8.1
Microsoft -> Windows rt
Microsoft -> Windows rt 8.1
Microsoft -> Windows server 2003
Microsoft -> Windows server 2008
Microsoft -> Windows server 2012
Microsoft -> Windows vista

References:

http://www.securityfocus.com/bid/68394

http://www.zerodayinitiative.com/advisories/ZDI-14-220/

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-040

https://www.exploit-db.com/exploits/39446/

https://www.exploit-db.com/exploits/39525/

Copyright 2024, cxsecurity.com