Executive Summary

Summary
Title Vulnerability in IME (Japanese) Could Allow Elevation of Privilege (2992719)
Informations
Name MS14-078 First vendor Publication 2014-11-11
Vendor Microsoft Last vendor Modification 2014-11-11
Severity (Vendor) Moderate Revision 1.0

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Severity Rating: Moderate
Revision Note: V1.0 (November 11, 2014): Bulletin published.
Summary: This security update resolves a privately reported vulnerability in Microsoft Input Method Editor (IME) (Japanese). The vulnerability could allow sandbox escape based on the application sandbox policy on a system where an affected version of the Microsoft IME (Japanese) is installed. An attacker who successfully exploited this vulnerability could escape the sandbox of a vulnerable application and gain access to the affected system with logged-in user rights. If the affected system is logged in with administrative rights, an attacker could then install programs; view, change or delete data; or create new accounts with full administrative rights.

Original Source

Url : https://technet.microsoft.com/en-us/library/security/MS14-078

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:27984
 
Oval ID: oval:org.mitre.oval:def:27984
Title: Microsoft IME (Japanese) elevation of privilege vulnerability - CVE-2014-4077 (MS14-078)
Description: Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.EXE (aka IME for Japanese) is installed, allow remote attackers to bypass a sandbox protection mechanism via a crafted PDF document, aka "Microsoft IME (Japanese) Elevation of Privilege Vulnerability," as exploited in the wild in 2014.
Family: windows Class: vulnerability
Reference(s): CVE-2014-4077
 Version: 3
Platform(s): Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows 8.1
 Product(s): Microsoft Input Method Editor Japanese
Microsoft Office IME Japanese 2007
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Os 1
Os 1
Os 3
Os 1

Information Assurance Vulnerability Management (IAVM)

Date Description
2014-11-13 IAVM : 2014-A-0179 - Microsoft Input Method Editor (IME) Privilege Escalation Vulnerability
Severity : Category I - VMSKEY : V0057395

Nessus® Vulnerability Scanner

Date Description
2014-11-12 Name : The remote Windows host is affected by a privilege escalation vulnerability.
File : smb_nt_ms14-078.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
Date Informations
2016-04-27 04:53:58
  • Multiple Updates
2015-10-18 17:26:24
  • Multiple Updates
2014-11-12 17:27:17
  • Multiple Updates
2014-11-12 13:27:29
  • Multiple Updates
2014-11-12 05:34:53
  • Multiple Updates
2014-11-11 21:28:12
  • Multiple Updates
2014-11-11 21:16:55
  • First insertion