Microsoft .NET Framework ClickOnce Remote Privilege Escalation Vulnerabilities

Summary

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 processes unverified data during interaction with the ClickOnce installer, which allows remote attackers to gain privileges via vectors involving Internet Explorer, aka ‘.NET ClickOnce Elevation of Privilege Vulnerability.’

Credit:

Details

Vulnerable Systems:
 * Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2

Immune Systems:
 * Microsoft .NET Framework after 4.5.2

Microsoft .NET Framework is prone to a remote privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges within the context of the application; this can result in the attacker gaining complete control of the affected system.

CVE Information:
CVE-2014-4073

Disclosure Timeline:
Original release date: 10/15/2014
Last revised: 10/31/2014

Categories: Windows