Executive Summary

TitleVulnerability in Microsoft Service Bus Could Allow Denial of Service (2972621)
NameMS14-042First vendor Publication2014-07-08
VendorMicrosoftLast vendor Modification2014-10-14
Severity (Vendor) ModerateRevision2.0

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:N/I:N/A:P)
Cvss Base Score4Attack RangeNetwork
Cvss Impact Score2.9Attack ComplexityLow
Cvss Expoit Score8AuthenticationRequires single instance
Calculate full CVSS 2.0 Vectors scores


Severity Rating: Moderate
Revision Note: V2.0 (October 14, 2014): Bulletin rereleased to announce the offering of the security update via Microsoft Update, in addition to the Download-Center-only option that was provided when this bulletin was originally released.
Summary: This security update resolves one publicly disclosed vulnerability in Microsoft Service Bus for Windows Server. The vulnerability could allow denial of service if a remote authenticated attacker creates and runs a program that sends a sequence of specially crafted Advanced Message Queuing Protocol (AMQP) messages to the target system. Microsoft Service Bus for Windows Server is not shipped with any Microsoft operating system. For an affected system to be vulnerable Microsoft Service Bus must first be downloaded, installed, and configured, and then its configuration details (farm certificate) shared with other users.

Original Source

Url : https://technet.microsoft.com/en-us/library/security/MS14-042

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:25184
Oval ID: oval:org.mitre.oval:def:25184
Title: Service Bus Denial of Service Vulnerability - CVE-2014-2814 (MS14-042)
Description: Microsoft Service Bus 1.1 on Microsoft Windows Server 2008 R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of service (AMQP messaging outage) via crafted AMQP messages, aka "Service Bus Denial of Service Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2014-2814
Version: 5
Platform(s): Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Product(s): Microsoft Service Bus 1.1
Definition Synopsis:

CPE : Common Platform Enumeration


Information Assurance Vulnerability Management (IAVM)

2014-07-10IAVM : 2014-B-0094 - Microsoft Service Bus Denial of Service Vulnerability
Severity : Category II - VMSKEY : V0052953

Nessus® Vulnerability Scanner

2014-07-08Name : The remote host has an application installed that is affected by a denial of ...
File : smb_nt_ms14-042.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
2014-10-14 21:27:34
  • Multiple Updates
2014-10-14 21:17:02
  • Multiple Updates
2014-07-12 00:21:51
  • Multiple Updates
2014-07-09 13:25:41
  • Multiple Updates
2014-07-09 05:27:34
  • Multiple Updates
2014-07-08 21:29:32
  • Multiple Updates
2014-07-08 21:18:18
  • First insertion