Microsoft Internet Explorer CVE-2014-2777 Remote Privilege Escalation Vulnerability

Bugtraq ID:	67892
Class:	Design Error
CVE:	CVE-2014-2777
Remote:	Yes
Local:	No
Published:	Jun 10 2014 12:00AM
Updated:	Mar 19 2015 09:07AM
Credit:	VUPEN, working with HP's Zero Day Initiative
Vulnerable:	Microsoft Internet Explorer 9 + Microsoft Windows 7 + Microsoft Windows 7 for 32-bit Systems SP1 + Microsoft Windows 7 for 32-bit Systems 0 + Microsoft Windows 7 for x64-based Systems SP1 + Microsoft Windows 7 for x64-based Systems 0 + Microsoft Windows 7 Home Premium - Sp1 X64 + Microsoft Windows 7 Home Premium - Sp1 X32 + Microsoft Windows Server 2008 R2 + Microsoft Windows Server 2008 for 32-bit Systems SP2 + Microsoft Windows Server 2008 for 32-bit Systems 0 + Microsoft Windows Server 2008 for x64-based Systems SP2 + Microsoft Windows Server 2008 for x64-based Systems 0 + Microsoft Windows Server 2008 R2 for x64-based Systems SP1 + Microsoft Windows Vista SP2 + Microsoft Windows Vista SP1 + Microsoft Windows Vista x64 Edition SP2 + Microsoft Windows Vista x64 Edition SP1 + Microsoft Windows Vista x64 Edition 0 Microsoft Internet Explorer 8 + Microsoft Windows 7 + Microsoft Windows 7 for 32-bit Systems SP1 + Microsoft Windows 7 for 32-bit Systems 0 + Microsoft Windows 7 for x64-based Systems SP1 + Microsoft Windows 7 for x64-based Systems 0 + Microsoft Windows 7 Home Premium 0 + Microsoft Windows 7 Home Premium - Sp1 X64 + Microsoft Windows 7 Home Premium - Sp1 X32 + Microsoft Windows Server 2008 R2 + Microsoft Windows Server 2003 Sp2 X64 + Microsoft Windows Server 2003 SP2 + Microsoft Windows Server 2003 Sp1 X64 + Microsoft Windows Server 2003 SP1 + Microsoft Windows Server 2008 R2 SP1 + Microsoft Windows Server 2008 for x64-based Systems SP2 + Microsoft Windows Server 2008 R2 x64 SP1 + Microsoft Windows Server 2008 R2 x64 0 + Microsoft Windows Server 2008 Standard Edition X64 + Microsoft Windows Server 2008 Standard Edition SP2 + Microsoft Windows Server 2008 Standard Edition 0 + Microsoft Windows Server 2008 Standard Edition - Sp2 Web + Microsoft Windows Vista SP2 + Microsoft Windows Vista SP1 + Microsoft Windows Vista Home Premium SP2 + Microsoft Windows Vista Home Premium SP1 + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Basic SP2 + Microsoft Windows Vista Home Basic SP1 + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Enterprise SP2 + Microsoft Windows Vista Enterprise SP1 + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Business SP2 + Microsoft Windows Vista Business SP1 + Microsoft Windows Vista 0 + Microsoft Windows Vista Business 64-bit edition SP2 + Microsoft Windows Vista Business 64-bit edition SP1 + Microsoft Windows Vista Business 64-bit edition 0 + Microsoft Windows Vista Enterprise 64-bit edition SP2 + Microsoft Windows Vista Enterprise 64-bit edition SP1 + Microsoft Windows Vista Enterprise 64-bit edition 0 + Microsoft Windows Vista Home Basic 64-bit edition Sp2 X64 + Microsoft Windows Vista Home Basic 64-bit edition SP2 + Microsoft Windows Vista Home Basic 64-bit edition SP1 + Microsoft Windows Vista Home Basic 64-bit edition 0 + Microsoft Windows Vista Home Premium 64-bit edition SP2 + Microsoft Windows Vista Home Premium 64-bit edition SP1 + Microsoft Windows Vista Home Premium 64-bit edition 0 + Microsoft Windows XP 0 + Microsoft Windows XP Embedded SP3 + Microsoft Windows XP Embedded SP2 + Microsoft Windows XP Embedded SP1 + Microsoft Windows XP Embedded + Microsoft Windows XP Home SP3 + Microsoft Windows XP Home SP2 + Microsoft Windows XP Home SP1 + Microsoft Windows XP Home + Microsoft Windows XP Media Center Edition SP3 + Microsoft Windows XP Media Center Edition SP2 + Microsoft Windows XP Media Center Edition SP1 + Microsoft Windows XP Professional SP3 + Microsoft Windows XP Professional SP2 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Professional x64 Edition Avaya Messaging Application Server 5.2 Avaya Meeting Exchange - Webportal 0 Avaya Communication Server 1000 Telephony Manager 4.0 Avaya Communication Server 1000 Telephony Manager 3.0 Avaya CallPilot 5.0 Avaya CallPilot 4.0 Avaya Aura Conferencing 6.0
Not Vulnerable:

Microsoft Internet Explorer CVE-2014-2777 Remote Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Microsoft Internet Explorer 10

• Microsoft Cumulative Security Update for Internet Explorer 10 in Windows 7 (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=004e9328-1552 -4669-9656-bd9f1f366fb8


• Microsoft Cumulative Security Update for Internet Explorer 10 in Windows 7 x64 Edition (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=103f2bc7-6ba3 -4473-bec9-5d79674d43c5


• Microsoft Cumulative Security Update for Internet Explorer 10 in Windows 8 (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=6a871fa0-cb61 -4407-916f-cd39a5f745e7


• Microsoft Cumulative Security Update for Internet Explorer 10 in Windows 8 x64 Edition (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=326e0381-bdd6 -47a9-bcff-936ec0206946


• Microsoft Cumulative Security Update for Internet Explorer 10 in Windows Server 2008 R2 x64 Edition (KB2957689
  http://www.microsoft.com/downloads/details.aspx?familyid=14e4403c-7645 -4035-a894-04daaf4c0029


• Microsoft Cumulative Security Update for Internet Explorer 10 in Windows Server 2012 x64 Edition (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=d62854de-8989 -43cd-9853-331ab51612f3

Microsoft Internet Explorer 9

• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows 7 (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=fe43424e-d874 -4140-a6ef-2d315276c371


• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows 7 x64 Edition (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=5f2ba337-1590 -477a-a8c1-f91cac634a2e


• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows Server 2008 (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=88e6c27d-04e2 -4813-b36a-927c366909b3


• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows Server 2008 R2 x64 Edition (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=025a0691-caa4 -49da-afe7-4d861243e4cc


• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows Server 2008 x64 Edition (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=a315f846-f456 -48e8-98bc-8270369031b2


• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows Vista (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=b0ad263f-235d -4df0-8ef5-539090d8795e


• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows Vista x64 Edition (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=90fe1cca-38f2 -4874-96d6-5536bf20facb

Microsoft Internet Explorer 8

• Microsoft Cumulative Security Update for Internet Explorer 8 for Windows Server 2003 (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=84397ecc-1ac0 -460a-a8ce-009cfd3b8f70


• Microsoft Cumulative Security Update for Internet Explorer 8 for Windows Server 2003 x64 Edition (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=f7c97c81-2602 -4fe5-809f-01ee7a0477a1


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows 7 (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=3d5d7f3f-37d7 -4222-8bf9-2e2122563307


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows 7 x64 Edition (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=d17499e2-3d54 -411d-a58a-9eda7bfc7de6


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows Server 2008 (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=2c0fd9fc-2ace -4978-88e0-1808b6ce75cb


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows Server 2008 R2 for Itanium-based Syste
  http://www.microsoft.com/downloads/details.aspx?familyid=7c5e65b5-c40a -4c3d-add8-52069dd8c3f8


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows Server 2008 R2 x64 Edition (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=dfe11af4-4b06 -4e8c-8575-0d5b6152d8a6


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows Server 2008 x64 Edition (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=64560dec-f9ae -4401-98d4-c03c075b5436


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows Vista (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=c88257d0-06fa -4db1-b1fe-714022b2ca3f


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows Vista x64 Edition (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=8802b041-c84c -4355-8c34-b30a309db1c7

Microsoft Internet Explorer 11

• Microsoft Cumulative Security Update for Internet Explorer 11 for Windows 8.1 (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=d8c3eddf-d05f -4073-8ca4-4af7542b78f8


• Microsoft Cumulative Security Update for Internet Explorer 11 for Windows 8.1 for x64-based systems (KB2957689
  http://www.microsoft.com/downloads/details.aspx?familyid=a2bd7a35-d6e4 -471d-af6f-79b81540c360


• Microsoft Cumulative Security Update for Internet Explorer 11 for Windows Server 2012 R2 (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=81088ad7-40e9 -49e5-9569-ccae1b8cac1a


• Microsoft Cumulative Security Update for Internet Explorer 11 in Windows 7 (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=f037482c-2974 -4b74-89f2-d7c35510b668


• Microsoft Cumulative Security Update for Internet Explorer 11 in Windows 7 x64 Edition (KB2957689)
  http://www.microsoft.com/downloads/details.aspx?familyid=7a0d4086-372a -4b23-993c-0197fa801906


• Microsoft Cumulative Security Update for Internet Explorer 11 in Windows Server 2008 R2 x64 Edition (KB2957689
  http://www.microsoft.com/downloads/details.aspx?familyid=ef2a0ccb-0aa4 -41b3-9a45-09acd7176cc8