exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 4 of 4 RSS Feed

CVE-2014-4971

Status Candidate

Overview

Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.

Related Files

Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation
Posted Oct 15, 2014
Authored by Matt Bergin, Jay Smith | Site metasploit.com

A vulnerability within Microsoft Bluetooth Personal Area Networking module, BthPan.sys, can allow an attacker to inject memory controlled by the attacker into an arbitrary location. This can be used by an attacker to overwrite HalDispatchTable+0x4 and execute arbitrary code by subsequently calling NtQueryIntervalProfile.

tags | exploit, arbitrary
advisories | CVE-2014-4971
SHA-256 | d94d249bed8485ab2ccc4e373683d6802502b4edd5262cd0b25082323dcef9a7
MQAC.sys Arbitrary Write Privilege Escalation
Posted Jul 25, 2014
Authored by Spencer McIntyre, Matt Bergin | Site metasploit.com

A vulnerability within the MQAC.sys module allows an attacker to overwrite an arbitrary location in kernel memory. This Metasploit module will elevate itself to SYSTEM, then inject the payload into another SYSTEM process.

tags | exploit, arbitrary, kernel
advisories | CVE-2014-4971
SHA-256 | c3dce854c36c28e545304c300892721f5fed0a84228f0ce24204cc34d072d2a6
Microsoft XP SP3 MQAC.sys Arbitrary Write Privilege Escalation
Posted Jul 21, 2014
Authored by Matthew Bergin

A vulnerability within the MQAC module allows an attacker to inject memory they control into an arbitrary location they define. This can be used by an attacker to overwrite HalDispatchTable+0x4 and execute arbitrary code by subsequently calling NtQueryIntervalProfile. Microsoft MQ Access Control version 5.1.0.1110 on XP SP3 is affected.

tags | exploit, arbitrary
advisories | CVE-2014-4971
SHA-256 | ac6de6f3a8cc010f9936f8753463cdbb1d352b1255340abf3d899a75f1c67f7b
Microsoft XP SP3 BthPan.sys Arbitrary Write Privilege Escalation
Posted Jul 21, 2014
Authored by Matthew Bergin

A vulnerability within the BthPan module allows an attacker to inject memory they control into an arbitrary location they define. This can be used by an attacker to overwrite HalDispatchTable+0x4 and execute arbitrary code by subsequently calling NtQueryIntervalProfile. Microsoft Bluetooth Personal Area Networking version 5.1.2600.5512 on XP SP3 is affected.

tags | exploit, arbitrary
advisories | CVE-2014-4971
SHA-256 | 9520a3d17643c7ebf1130b867b4f899c083ee1d3103c9e343a9e895529ec8545
Page 1 of 1
Back1Next

File Archive:

September 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    261 Files
  • 2
    Sep 2nd
    17 Files
  • 3
    Sep 3rd
    38 Files
  • 4
    Sep 4th
    52 Files
  • 5
    Sep 5th
    23 Files
  • 6
    Sep 6th
    27 Files
  • 7
    Sep 7th
    0 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    16 Files
  • 10
    Sep 10th
    38 Files
  • 11
    Sep 11th
    21 Files
  • 12
    Sep 12th
    40 Files
  • 13
    Sep 13th
    18 Files
  • 14
    Sep 14th
    0 Files
  • 15
    Sep 15th
    0 Files
  • 16
    Sep 16th
    21 Files
  • 17
    Sep 17th
    51 Files
  • 18
    Sep 18th
    23 Files
  • 19
    Sep 19th
    48 Files
  • 20
    Sep 20th
    36 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close