CVE-2014-4073
First published: Wed Oct 15 2014(Updated: )
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 processes unverified data during interaction with the ClickOnce installer, which allows remote attackers to gain privileges via vectors involving Internet Explorer, aka ".NET ClickOnce Elevation of Privilege Vulnerability."
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft .NET Framework 4 | =2.0-sp2 | |
| Microsoft .NET Framework 4 | =3.5 | |
| Microsoft .NET Framework 4 | =3.5.1 | |
| Microsoft .NET Framework 4 | =4.0 | |
| Microsoft .NET Framework 4 | =4.5 | |
| Microsoft .NET Framework 4 | =4.5.1 | |
| Microsoft .NET Framework 4 | =4.5.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://blogs.technet.com/b/srd/archive/2014/10/14/more-details-about-cve-2014-4073-elevation-of-privilege-vulnerability.aspx
- http://secunia.com/advisories/60969
- http://www.securityfocus.com/bid/70313
- http://www.securitytracker.com/id/1031021
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-057
Frequently Asked Questions
What is the severity of CVE-2014-4073?
CVE-2014-4073 has a severity rating categorized as 'important' due to the potential for privilege escalation.
How do I fix CVE-2014-4073?
To fix CVE-2014-4073, Microsoft recommends applying the latest security updates for the .NET Framework.
What versions of Microsoft .NET Framework are affected by CVE-2014-4073?
CVE-2014-4073 affects Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2.
What type of vulnerability is CVE-2014-4073?
CVE-2014-4073 is classified as an Elevation of Privilege vulnerability which allows remote attackers to gain higher access rights.
Can CVE-2014-4073 be exploited remotely?
Yes, CVE-2014-4073 can be exploited remotely through unverified data interaction with the ClickOnce installer.
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/description
- agent/tags
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/microsoft
- canonical/microsoft .net framework 4
- version/microsoft .net framework 4/2.0-sp2
- version/microsoft .net framework 4/3.5
- version/microsoft .net framework 4/3.5.1
- version/microsoft .net framework 4/4.0
- version/microsoft .net framework 4/4.5
- version/microsoft .net framework 4/4.5.1
- version/microsoft .net framework 4/4.5.2