CVE-2014-4971

🗓️ 26 Jul 2014 15:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 83 Views🌐 WEB

Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, allowing local users to write data to arbitrary memory locations

Reporter	Title	Published	Views	Family All 34
0day.today	Microsoft XP SP3 BthPan.sys - Arbitrary Write Privilege Escalation	22 Jul 201400:00	–	zdt
0day.today	Microsoft XP SP3 MQAC.sys - Arbitrary Write Privilege Escalation Exploit	22 Jul 201400:00	–	zdt
0day.today	MQAC.sys Arbitrary Write Privilege Escalation Exploit	25 Jul 201400:00	–	zdt
0day.today	Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation	16 Oct 201400:00	–	zdt
BDU FSTEC	The vulnerability of the Windows operating system, which allows a perpetrator to increase their privileges or execute arbitrary code	6 Jul 201600:00	–	bdu_fstec
Circl	CVE-2014-4971	25 Jul 201400:00	–	circl
Cvelist	CVE-2014-4971	26 Jul 201415:00	–	cvelist
Exploit DB	Microsoft Windows XP SP3 - 'MQAC.sys' Arbitrary Write Privilege Escalation	19 Jul 201400:00	–	exploitdb
Exploit DB	Microsoft Windows XP SP3 - 'BthPan.sys' Arbitrary Write Privilege Escalation	21 Jul 201400:00	–	exploitdb
Exploit DB	Microsoft Windows XP SP3 - 'MQAC.sys' Arbitrary Write Privilege Escalation (Metasploit)	25 Jul 201400:00	–	exploitdb

NVD

Node

microsoft windows_xpsp3

Source	Link
securityfocus	www.securityfocus.com/archive/1/532843/100/0/threaded
securityfocus	www.securityfocus.com/archive/1/532844/100/0/threaded
seclists	www.seclists.org/fulldisclosure/2014/Jul/97
securitytracker	www.securitytracker.com/id/1031025
seclists	www.seclists.org/fulldisclosure/2014/Jul/96
packetstormsecurity	www.packetstormsecurity.com/files/127536/Microsoft-XP-SP3-MQAC.sys-Arbitrary-Write-Privilege-Escalation.html
korelogic	www.korelogic.com/Resources/Advisories/KL-001-2014-002.txt
packetstormsecurity	www.packetstormsecurity.com/files/128674/Microsoft-Bluetooth-Personal-Area-Networking-BthPan.sys-Privilege-Escalation.html
exploit-db	www.exploit-db.com/exploits/34112
blogs	www.blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx

Parameter	Position	Path	Description	CWE
IoControlCode	path	\\.\\bthpan	Privilege escalation via BthPan.sys in Microsoft Bluetooth Personal Area Networking by crafting an IOCTL to overwrite HalDispatchTable/ Hal dispatch and gain system privileges.	CWE-20
InputBuffer	path	\\.\\bthpan	Privilege escalation via BthPan.sys in Microsoft Bluetooth Personal Area Networking by crafting an IOCTL to overwrite HalDispatchTable/ Hal dispatch and gain system privileges.	CWE-20
OutputBuffer	path	\\.\\bthpan	Privilege escalation via BthPan.sys in Microsoft Bluetooth Personal Area Networking by crafting an IOCTL to overwrite HalDispatchTable/ Hal dispatch and gain system privileges.	CWE-20
InBufferSize	path	\\.\\bthpan	Privilege escalation via BthPan.sys in Microsoft Bluetooth Personal Area Networking by crafting an IOCTL to overwrite HalDispatchTable/ Hal dispatch and gain system privileges.	CWE-20
OutBufferSize	path	\\.\\bthpan	Privilege escalation via BthPan.sys in Microsoft Bluetooth Personal Area Networking by crafting an IOCTL to overwrite HalDispatchTable/ Hal dispatch and gain system privileges.	CWE-20

17 Jun 2026 00:10Current

6.2Medium risk

Vulners AI Score6.2

CVSS 27.2

EPSS0.23046

CWE-20

microsoft windows xp sp3 irp handler routines local users memory locations privileges ioctl mqac.sys mq access control subsystem bthpan.sys bluetooth personal area networking subsystem security vulnerability nvd cve-2014-4971