CVE-2014-4076 Privilege escalation in n/a

What is CVE-2014-4076?

CVE-2014-4076 is a high-severity vulnerability in Microsoft Windows Server 2003, published on 11 Nov 2014. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Microsoft Windows Server 2003 SP2 allows local users to gain privileges via a crafted IOCTL call to (1) tcpip.sys or (2) tcpip6.sys, aka "TCP/IP Elevation of Privilege Vulnerability."

Weakness: CWE-264

Which versions are affected by CVE-2014-4076?

It affects 1 product.

Products include Microsoft Windows Server 2003.

How do I fix CVE-2014-4076?

No fix has been published for CVE-2014-4076 yet. Limit exposure of the affected software until one is available.

Is CVE-2014-4076 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-4076 exists.

Public exploit code: 1 Metasploit module, 2 Exploit-DB entries and 1 proofs of concept on GitHub.

Other vulnerabilities in Microsoft Windows Server 2003

• CVE-2011-2005 Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Exploited High 7.8
• CVE-2013-3863 Memory corruption in n/a Critical 9.3
• CVE-2013-3181 Memory corruption in n/a Critical 9.3
• CVE-2013-0077 Code injection in n/a Critical 9.3
• CVE-2012-0009 Path traversal in n/a Critical 9.3

All Microsoft Windows Server 2003 vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wcj9-qvpq-7gwq.