BID:70937

Microsoft Internet Information Services CVE-2014-8985 Security Bypass Vulnerability

CVE-2014-8985 |

Info

Microsoft Internet Information Services CVE-2014-8985 Security Bypass Vulnerability

Bugtraq ID:	70937
Class:	Access Validation Error
CVE:	CVE-2014-4078 CVE-2014-8985
Remote:	Yes
Local:	No
Published:	Nov 11 2014 12:00AM
Updated:	Feb 09 2018 11:00AM
Credit:	Microsoft
Vulnerable:	Microsoft Internet Explorer 11 + Microsoft Windows 10 for 32-bit Systems 0 + Microsoft Windows 10 for 32-bit Systems 0 + Microsoft Windows 10 for 32-bit Systems 0 + Microsoft Windows 10 for 32-bit Systems 0 + Microsoft Windows 10 for x64-based Systems 0 + Microsoft Windows 10 for x64-based Systems 0 + Microsoft Windows 10 for x64-based Systems 0 + Microsoft Windows 10 for x64-based Systems 0 + Microsoft Windows 10 version 1511 for 32-bit Systems 0 + Microsoft Windows 10 version 1511 for 32-bit Systems 0 + Microsoft Windows 10 version 1511 for 32-bit Systems 0 + Microsoft Windows 10 version 1511 for 32-bit Systems 0 + Microsoft Windows 10 version 1511 for x64-based Systems 0 + Microsoft Windows 10 version 1511 for x64-based Systems 0 + Microsoft Windows 10 version 1511 for x64-based Systems 0 + Microsoft Windows 10 version 1511 for x64-based Systems 0 + Microsoft Windows 10 Version 1607 for 32-bit Systems 0 + Microsoft Windows 10 Version 1607 for 32-bit Systems 0 + Microsoft Windows 10 Version 1607 for x64-based Systems 0 + Microsoft Windows 10 Version 1607 for x64-based Systems 0 + Microsoft Windows 10 version 1703 for 32-bit Systems 0 + Microsoft Windows 10 version 1703 for 32-bit Systems 0 + Microsoft Windows 10 version 1703 for x64-based Systems 0 + Microsoft Windows 10 version 1703 for x64-based Systems 0 + Microsoft Windows 10 version 1709 for 32-bit Systems 0 + Microsoft Windows 10 version 1709 for x64-based Systems 0 + Microsoft Windows 7 for 32-bit Systems SP1 + Microsoft Windows 7 for 32-bit Systems SP1 + Microsoft Windows 7 for 32-bit Systems SP1 + Microsoft Windows 7 for 32-bit Systems SP1 + Microsoft Windows 7 for x64-based Systems SP1 + Microsoft Windows 7 for x64-based Systems SP1 + Microsoft Windows 7 for x64-based Systems SP1 + Microsoft Windows 7 for x64-based Systems SP1 + Microsoft Windows 8.1 for 32-bit Systems 0 + Microsoft Windows 8.1 for 32-bit Systems 0 + Microsoft Windows 8.1 for 32-bit Systems 0 + Microsoft Windows 8.1 for 32-bit Systems 0 + Microsoft Windows 8.1 for x64-based Systems 0 + Microsoft Windows 8.1 for x64-based Systems 0 + Microsoft Windows 8.1 for x64-based Systems 0 + Microsoft Windows 8.1 for x64-based Systems 0 + Microsoft Windows Rt 8.1 - + Microsoft Windows Rt 8.1 - + Microsoft Windows Rt 8.1 - + Microsoft Windows Rt 8.1 - + Microsoft Windows Server 2016 + Microsoft Windows Server 2016 + Microsoft Windows Server 2008 R2 for Itanium-based Systems SP2 + Microsoft Windows Server 2008 R2 for Itanium-based Systems SP2 + Microsoft Windows Server 2008 R2 for Itanium-based Systems SP2 + Microsoft Windows Server 2008 R2 for x64-based Systems SP1 + Microsoft Windows Server 2008 R2 for x64-based Systems SP1 + Microsoft Windows Server 2008 R2 for x64-based Systems SP1 + Microsoft Windows Server 2008 R2 for x64-based Systems SP1 + Microsoft Windows Server 2012 R2 0 + Microsoft Windows Server 2012 R2 0 + Microsoft Windows Server 2012 R2 0 + Microsoft Windows Server 2012 R2 0 Microsoft IIS 8.5 Microsoft IIS 8.0

Not Vulnerable:

Discussion

Microsoft Internet Information Services CVE-2014-8985 Security Bypass Vulnerability

Microsoft Internet Information Services is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and gain unauthorized access; this may aid in launching further attacks.

Note: This issue was previously titled 'Microsoft Internet Information Services CVE-2014-4078 Security Bypass Vulnerability'. The title has been changed to better reflect the vulnerability information.

Exploit / POC

Microsoft Internet Information Services CVE-2014-8985 Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

Microsoft Internet Information Services CVE-2014-8985 Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Microsoft IIS 8.5

Microsoft Security Update for Windows 8.1 (KB2982998)
http://www.microsoft.com/downloads/details.aspx?familyid=633e764f-d352 -4c04-b759-82464646a745

Microsoft Security Update for Windows 8.1 for x64-based Systems (KB2982998)
http://www.microsoft.com/downloads/details.aspx?familyid=c6e4ef0e-2c9f -4332-8d47-bba248afcf1e

Microsoft Security Update for Windows Server 2012 R2 (KB2982998)
http://www.microsoft.com/downloads/details.aspx?familyid=1e33f0f0-7058 -419f-a323-3568ec2e3533

Microsoft IIS 8.0

Microsoft Security Update for Windows 8 (KB2982998)
http://www.microsoft.com/downloads/details.aspx?familyid=f42e57b7-ff7c -4f2a-80a7-3afe70c74387

Microsoft Security Update for Windows 8 for x64-based Systems (KB2982998)
http://www.microsoft.com/downloads/details.aspx?familyid=494d71be-c28a -4897-a741-5439bf780a96

Microsoft Security Update for Windows Server 2012 (KB2982998)
http://www.microsoft.com/downloads/details.aspx?familyid=821664b2-d1a4 -4037-baea-b936ebef7730

References

Microsoft Internet Information Services CVE-2014-8985 Security Bypass Vulnerability

References:

Microsoft Homepage (Microsoft)
Microsoft Security Bulletin MS14-051 - Critical (Microsoft)
Microsoft Security Bulletin MS14-076 (Microsoft)