Microsoft Internet Explorer CVE-2014-4140 ASLR Security Bypass Vulnerability

Bugtraq ID:	70325
Class:	Design Error
CVE:	CVE-2014-4140
Remote:	Yes
Local:	No
Published:	Oct 14 2014 12:00AM
Updated:	Mar 19 2015 09:37AM
Credit:	John Villamil (@day6reak)
Vulnerable:	Microsoft Internet Explorer 9 + Microsoft Windows 7 + Microsoft Windows 7 for 32-bit Systems SP1 + Microsoft Windows 7 for 32-bit Systems 0 + Microsoft Windows 7 for x64-based Systems SP1 + Microsoft Windows 7 for x64-based Systems 0 + Microsoft Windows 7 Home Premium - Sp1 X64 + Microsoft Windows 7 Home Premium - Sp1 X32 + Microsoft Windows Server 2008 R2 + Microsoft Windows Server 2008 for 32-bit Systems SP2 + Microsoft Windows Server 2008 for 32-bit Systems 0 + Microsoft Windows Server 2008 for x64-based Systems SP2 + Microsoft Windows Server 2008 for x64-based Systems 0 + Microsoft Windows Server 2008 R2 for x64-based Systems SP1 + Microsoft Windows Vista SP2 + Microsoft Windows Vista SP1 + Microsoft Windows Vista x64 Edition SP2 + Microsoft Windows Vista x64 Edition SP1 + Microsoft Windows Vista x64 Edition 0 Avaya Messaging Application Server 5.2 Avaya Communication Server 1000 Telephony Manager 4.0 Avaya Communication Server 1000 Telephony Manager 3.0 Avaya CallPilot 4.0
Not Vulnerable:

Microsoft Internet Explorer CVE-2014-4140 ASLR Security Bypass Vulnerability

Microsoft Internet Explorer is prone to a security-bypass vulnerability.

An attacker can leverage this issue to bypass certain security restrictions and execute arbitrary code by exploiting another vulnerability in the application.

Microsoft Internet Explorer CVE-2014-4140 ASLR Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Microsoft Internet Explorer 10

• Microsoft Cumulative Security Update for Internet Explorer 10 for Windows 7 Service Pack 1 (KB2987107)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=cae07eee-7f98 -4a0c-b2ad-14d873028371


• Microsoft Cumulative Security Update for Internet Explorer 10 for Windows 7 Service Pack 1 for x64-based Syste
  http://www.microsoft.com/downloads/details.aspx?FamilyID=b9f593c9-1500 -442e-9188-678b33db6fc7


• Microsoft Cumulative Security Update for Internet Explorer 10 for Windows 8 (KB2987107)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=75c45847-ea0d -4911-b972-371134e26219


• Microsoft Cumulative Security Update for Internet Explorer 10 for Windows 8 for x64-based Systems (KB2987107)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=f246ef71-82b5 -4232-bf04-534d883f052f


• Microsoft Cumulative Security Update for Internet Explorer 10 for Windows Server 2008 R2 Service Pack 1 for x6
  http://www.microsoft.com/downloads/details.aspx?FamilyID=5c048bab-042e -43f1-8da0-ed551c470cf3


• Microsoft Cumulative Security Update for Internet Explorer 10 for Windows Server 2012 (KB2987107)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=b6a432b3-5e31 -4363-b2cb-c2f16e93f9a4

Microsoft Internet Explorer 11

• Microsoft Cumulative Security Update for Internet Explorer 11 for Windows 7 (KB2987107)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=6f7630b4-5888 -4e27-ab34-acc09a09146e


• Microsoft Cumulative Security Update for Internet Explorer 11 for Windows 7 for x64-based Systems (KB2987107)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=ddd03c82-7d6a -452a-849f-24cf1d7f1908


• Microsoft Cumulative Security Update for Internet Explorer 11 for Windows 8.1 (KB2987107)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=e2e26909-2a1d -4e95-98df-435010882f77


• Microsoft Cumulative Security Update for Internet Explorer 11 for Windows 8.1 for x64-based Systems (KB2987107
  http://www.microsoft.com/downloads/details.aspx?FamilyID=47a5bf9d-6ce3 -49ef-bf07-863716917eeb


• Microsoft Cumulative Security Update for Internet Explorer 11 for Windows Server 2008 R2 for x64-based Systems
  http://www.microsoft.com/downloads/details.aspx?FamilyID=93a6b92a-7aee -42a8-a4ea-fc7eeb897194


• Microsoft Cumulative Security Update for Internet Explorer 11 for Windows Server 2012 R2 (KB2987107)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=d60b1064-a617 -4ebc-b41a-fe53d9deb519

Microsoft Internet Explorer 9

• Microsoft Cumulative Security Update for Internet Explorer 9 for Windows 7 (KB2987107)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=b520ed46-d1e3 -4425-b640-36399b70fc81


• Microsoft Cumulative Security Update for Internet Explorer 9 for Windows 7 for x64-based Systems (KB2987107)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=dd796fec-7d42 -4d3f-aece-92462ae76494


• Microsoft Cumulative Security Update for Internet Explorer 9 for Windows Server 2008 (KB2987107)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=106329fa-a7c0 -47c8-b61c-8206ff85650a


• Microsoft Cumulative Security Update for Internet Explorer 9 for Windows Server 2008 R2 x64 Edition (KB2987107
  http://www.microsoft.com/downloads/details.aspx?FamilyID=28fd54d2-f2e4 -402a-b7a4-f58f66c18975


• Microsoft Cumulative Security Update for Internet Explorer 9 for Windows Server 2008 x64 Edition (KB2987107)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=e3ec5e1e-521a -428d-b1ba-df20bcb8db11


• Microsoft Cumulative Security Update for Internet Explorer 9 for Windows Vista (KB2987107)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=077d0cb0-b5aa -47f8-b976-763ab416de7a


• Microsoft Cumulative Security Update for Internet Explorer 9 for Windows Vista for x64-based Systems (KB298710
  http://www.microsoft.com/downloads/details.aspx?FamilyID=e47327af-a8b4 -4f26-8d5f-b1d669355bf5

Microsoft Internet Explorer CVE-2014-4140 ASLR Security Bypass Vulnerability

References:

• Microsoft Internet Explorer Homepage (Microsoft)
  
• Microsoft Security Bulletin MS14-056 (Microsoft)
  
• MS14-056 Cumulative Security Update for Internet Explorer (2987107) (Avaya)