CVE-2014-4077
Published: 11 November 2014
Summary
CVE-2014-4077 is a high-severity an unspecified weakness vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 2.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2014-4077 is an elevation-of-privilege vulnerability in the Japanese Input Method Editor (IME) component IMJPDCT.EXE. It affects Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3 when the IME for Japanese is installed. The flaw permits a sandbox protection mechanism to be bypassed when a specially crafted PDF document is processed.
Remote attackers can exploit the issue by supplying a malicious PDF that triggers the IME code path, allowing code execution at a higher privilege level than the sandbox would normally permit. The attack requires user interaction to open the document but needs no additional privileges on the target system.
Microsoft addressed the vulnerability in security bulletin MS14-078, released as part of the November 2014 security updates. Corresponding guidance on risk assessment and patch deployment appears in the associated TechNet Security Research & Defense blog posts.
The vulnerability was exploited in the wild in 2014.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2014-4008
Vulnerability details
Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.EXE (aka IME for Japanese) is installed, allow remote attackers to bypass a sandbox protection mechanism via…
more
a crafted PDF document, aka "Microsoft IME (Japanese) Elevation of Privilege Vulnerability," as exploited in the wild in 2014.
- CWE(s)
- KEV Date Added
- 25 May 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of the vendor patch (MS14-078) that eliminates the IME sandbox-bypass flaw before exploitation.
Enforces least functionality by disabling or not installing the Japanese IME (IMJPDCT.EXE) when it is not required, removing the vulnerable code path entirely.
Malicious-code protections can block or detect the specially crafted PDF that triggers the IME elevation-of-privilege exploit.