Executive Summary

Title Vulnerability in Microsoft Service Bus Could Allow Denial of Service (2972621)
Name MS14-042 First vendor Publication 2014-07-08
Vendor Microsoft Last vendor Modification 2014-10-14
Severity (Vendor) Moderate Revision 2.0

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:N/I:N/A:P)
Cvss Base Score 4 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 8 Authentication Requires single instance
Calculate full CVSS 2.0 Vectors scores


Severity Rating: Moderate
Revision Note: V2.0 (October 14, 2014): Bulletin rereleased to announce the offering of the security update via Microsoft Update, in addition to the Download-Center-only option that was provided when this bulletin was originally released.
Summary: This security update resolves one publicly disclosed vulnerability in Microsoft Service Bus for Windows Server. The vulnerability could allow denial of service if a remote authenticated attacker creates and runs a program that sends a sequence of specially crafted Advanced Message Queuing Protocol (AMQP) messages to the target system. Microsoft Service Bus for Windows Server is not shipped with any Microsoft operating system. For an affected system to be vulnerable Microsoft Service Bus must first be downloaded, installed, and configured, and then its configuration details (farm certificate) shared with other users.

Original Source

Url : https://technet.microsoft.com/en-us/library/security/MS14-042

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:25184
Oval ID: oval:org.mitre.oval:def:25184
Title: Service Bus Denial of Service Vulnerability - CVE-2014-2814 (MS14-042)
Description: Microsoft Service Bus 1.1 on Microsoft Windows Server 2008 R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of service (AMQP messaging outage) via crafted AMQP messages, aka "Service Bus Denial of Service Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2014-2814
Version: 5
Platform(s): Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Product(s): Microsoft Service Bus 1.1
Definition Synopsis:

CPE : Common Platform Enumeration

Application 1

Information Assurance Vulnerability Management (IAVM)

Date Description
2014-07-10 IAVM : 2014-B-0094 - Microsoft Service Bus Denial of Service Vulnerability
Severity : Category II - VMSKEY : V0052953

Nessus® Vulnerability Scanner

Date Description
2014-07-08 Name : The remote host has an application installed that is affected by a denial of ...
File : smb_nt_ms14-042.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
Date Informations
2014-10-14 21:27:34
  • Multiple Updates
2014-10-14 21:17:02
  • Multiple Updates
2014-07-12 00:21:51
  • Multiple Updates
2014-07-09 13:25:41
  • Multiple Updates
2014-07-09 05:27:34
  • Multiple Updates
2014-07-08 21:29:32
  • Multiple Updates
2014-07-08 21:18:18
  • First insertion