CVE-2014-6332
Published: 11 November 2014
Summary
CVE-2014-6332 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-18 (Mobile Code) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2014-6332 is a remote code execution vulnerability in OleAut32.dll within the OLE component of Microsoft Windows. It affects Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1. The flaw stems from improper handling of a size value during array redimensioning in the SafeArrayDimen function, classified under CWE-119, and carries a CVSS 3.1 score of 8.8.
Remote attackers can exploit the issue by serving a crafted website that triggers the vulnerability, achieving arbitrary code execution on the target system without requiring authentication. User interaction, such as visiting the malicious page, is needed, after which the attacker gains full control over confidentiality, integrity, and availability on the affected host.
Public references demonstrate multiple working remote code execution proofs-of-concept that leverage the vulnerability through browsers such as Avant Browser and TheWorld Browser, as well as Microsoft Compiled HTML Help files and applications including Winamp and HTML Compiler packages.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2014-6216
Vulnerability details
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote…
more
attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka "Windows OLE Automation Array Remote Code Execution Vulnerability."
- CWE(s)
- KEV Date Added
- 25 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly restricts execution of mobile code (scripts/ActiveX/OLE objects) delivered by crafted web pages that trigger the SafeArrayDimen flaw.
Deploys malicious-code detection and blocking mechanisms that can identify and stop the browser-delivered exploit before arbitrary code runs.
Requires timely application of patches that remediate the underlying OLE Automation array-handling vulnerability in OleAut32.dll.