CVE-2014-1764
Microsoft Internet Explorer Protected Mode Bypass Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism by leveraging "object confusion" in a broker process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.
Microsoft Internet Explorer 7 hasta la versión 11 permite a atacantes remotos ejecutar código arbitrario y eludir un mecanismo de protección sandbox aprovechando "confusión de objeto" en un proceso broker, según lo demostrado por VUPEN durante una competición Pwn2Own en CanSecWest 2014.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the processing of data shared to the broker by the sandboxed process. The issue lies in the failure to validate an object's type. An attacker can leverage this vulnerability to execute code as the context of the current user at medium integrity.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2014-01-29 CVE Reserved
- 2014-04-27 CVE Published
- 2014-07-08 First Exploit
- 2024-03-09 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://twitter.com/thezdi/statuses/443855973673754624 | X_refsource_misc | |
| http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one | X_refsource_misc | |
| http://www.securityfocus.com/archive/1/532798/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/bid/67295 | Vdb Entry | |
| http://www.securitytracker.com/id/1030370 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/34010 | 2014-07-08 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-035 | 2018-10-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Microsoft Search vendor "Microsoft" | Internet Explorer Search vendor "Microsoft" for product "Internet Explorer" | 7 Search vendor "Microsoft" for product "Internet Explorer" and version "7" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Internet Explorer Search vendor "Microsoft" for product "Internet Explorer" | 8 Search vendor "Microsoft" for product "Internet Explorer" and version "8" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Internet Explorer Search vendor "Microsoft" for product "Internet Explorer" | 9 Search vendor "Microsoft" for product "Internet Explorer" and version "9" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Internet Explorer Search vendor "Microsoft" for product "Internet Explorer" | 10 Search vendor "Microsoft" for product "Internet Explorer" and version "10" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Internet Explorer Search vendor "Microsoft" for product "Internet Explorer" | 11 Search vendor "Microsoft" for product "Internet Explorer" and version "11" | - |
Affected
| ||||||