Vulnerability in Microsoft Windows_server_2003

CVE-2014-4076

Microsoft Windows Server 2003 SP2 allows local users to gain privileges via a crafted IOCTL call to (1) tcpip.sys or (2) tcpip6.sys, aka "TCP/IP Elevation of Privilege Vulnerability."

EPSS: 0.585 (98.2th percentile) — read the EPSS interpretation.

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

  • MS14-070 (x_refsource_MS, vendor-advisory)
  • 114532 (x_refsource_OSVDB, vdb-entry)
  • 37755 (exploit, x_refsource_EXPLOIT-DB)
  • 35936 (Exploit, exploit, x_refsource_EXPLOIT-DB)
  • 70976 (vdb-entry, x_refsource_BID)

Frequently asked questions

What is CVE-2014-4076?
CVE-2014-4076 is a vulnerability in Microsoft Windows_server_2003, classified under CWE-264. Published 2014-11-11.
Is CVE-2014-4076 known to be exploited?
9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.