exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 4 of 4 RSS Feed

CVE-2014-4971

Status Candidate

Overview

Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.

Related Files

Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation
Posted Oct 15, 2014
Authored by Matt Bergin, Jay Smith | Site metasploit.com

A vulnerability within Microsoft Bluetooth Personal Area Networking module, BthPan.sys, can allow an attacker to inject memory controlled by the attacker into an arbitrary location. This can be used by an attacker to overwrite HalDispatchTable+0x4 and execute arbitrary code by subsequently calling NtQueryIntervalProfile.

tags | exploit, arbitrary
advisories | CVE-2014-4971
SHA-256 | d94d249bed8485ab2ccc4e373683d6802502b4edd5262cd0b25082323dcef9a7
MQAC.sys Arbitrary Write Privilege Escalation
Posted Jul 25, 2014
Authored by Spencer McIntyre, Matt Bergin | Site metasploit.com

A vulnerability within the MQAC.sys module allows an attacker to overwrite an arbitrary location in kernel memory. This Metasploit module will elevate itself to SYSTEM, then inject the payload into another SYSTEM process.

tags | exploit, arbitrary, kernel
advisories | CVE-2014-4971
SHA-256 | c3dce854c36c28e545304c300892721f5fed0a84228f0ce24204cc34d072d2a6
Microsoft XP SP3 MQAC.sys Arbitrary Write Privilege Escalation
Posted Jul 21, 2014
Authored by Matthew Bergin

A vulnerability within the MQAC module allows an attacker to inject memory they control into an arbitrary location they define. This can be used by an attacker to overwrite HalDispatchTable+0x4 and execute arbitrary code by subsequently calling NtQueryIntervalProfile. Microsoft MQ Access Control version 5.1.0.1110 on XP SP3 is affected.

tags | exploit, arbitrary
advisories | CVE-2014-4971
SHA-256 | ac6de6f3a8cc010f9936f8753463cdbb1d352b1255340abf3d899a75f1c67f7b
Microsoft XP SP3 BthPan.sys Arbitrary Write Privilege Escalation
Posted Jul 21, 2014
Authored by Matthew Bergin

A vulnerability within the BthPan module allows an attacker to inject memory they control into an arbitrary location they define. This can be used by an attacker to overwrite HalDispatchTable+0x4 and execute arbitrary code by subsequently calling NtQueryIntervalProfile. Microsoft Bluetooth Personal Area Networking version 5.1.2600.5512 on XP SP3 is affected.

tags | exploit, arbitrary
advisories | CVE-2014-4971
SHA-256 | 9520a3d17643c7ebf1130b867b4f899c083ee1d3103c9e343a9e895529ec8545
Page 1 of 1
Back1Next

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close