Microsoft Security Bulletin MS14-004 - Important

Vulnerability in Microsoft Dynamics AX Could Allow Denial of Service (2880826)

Published: January 14, 2014

Version: 1.0

General Information

Executive Summary

This security update resolves one privately reported vulnerability in Microsoft Dynamics AX. The vulnerability could allow denial of service if an authenticated attacker submits specially crafted data to an affected Microsoft Dynamics AX Application Object Server (AOS) instance. An attacker who successfully exploited this vulnerability could cause the target AOS instance to stop responding to client requests.

This security update is rated Important for all supported editions of Microsoft Dynamics AX 4.0, Microsoft Dynamics AX 2009, Microsoft Dynamics AX 2012, and Microsoft Dynamics AX 2012 R2. For more information, see the subsection, Affected and Non-Affected Software, in this section.

The security update addresses the vulnerability by helping to ensure that Microsoft Dynamics AX properly handles data provided by a user. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry later in this bulletin.

Recommendation.  Microsoft recommends that customers apply the update at the earliest opportunity.

See also the section, Detection and Deployment Tools and Guidance, later in this bulletin.

Knowledge Base Article

  • Knowledge Base Article: 2880826
  • File Information: Yes
  • SHA1/SHA2 hashes: Yes
  • Known issues: None

 

Affected and Non-Affected Software

The following software has been tested to determine which versions or editions are affected. Other versions or editions are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see Microsoft Support Lifecycle.

Affected Software

Software Maximum Security Impact Aggregate Severity Rating Updates Replaced
Microsoft Dynamics AX 4.0
Microsoft Dynamics AX 4.0 Service Pack 2[1](2920510) Denial of Service Important None
Microsoft Dynamics AX 2009
Microsoft Dynamics AX 2009 Service Pack 1[1](2914058) Denial of Service Important None
Microsoft Dynamics AX 2012 and Microsoft Dynamics AX 2012 R2
Microsoft Dynamics AX 2012[1](2914055) Denial of Service Important None
Microsoft Dynamics AX 2012 R2[1](2914057) Denial of Service Important None

[1]This update is available from the Microsoft Download Center, Microsoft Dynamics CustomerSource, and Microsoft Dynamics PartnerSource only.

Update FAQ

Why are the updates only available from the Microsoft Download Center, Microsoft Dynamics CustomerSource, and Microsoft Dynamics PartnerSource?
Due to the servicing model for Microsoft Dynamics AX updates, Microsoft is releasing these updates to the Microsoft Download Center, Microsoft Dynamics CustomerSource, and Microsoft Dynamics PartnerSource only.

I am using an older release of the software discussed in this security bulletin. What should I do?
The affected software listed in this bulletin has been tested to determine which releases are affected. Other releases are past their support life cycle. For more information about the product lifecycle, see the Microsoft Support Lifecycle website.

It should be a priority for customers who have older releases of the software to migrate to supported releases to prevent potential exposure to vulnerabilities. To determine the support lifecycle for your software release, see Select a Product for Lifecycle Information. For more information about service packs for these software releases, see Service Pack Lifecycle Support Policy.

Customers who require custom support for older software must contact their Microsoft account team representative, their Technical Account Manager, or the appropriate Microsoft partner representative for custom support options. Customers without an Alliance, Premier, or Authorized Contract can contact their local Microsoft sales office. For contact information, see the Microsoft Worldwide Information website, select the country in the Contact Information list, and then click Go to see a list of telephone numbers. When you call, ask to speak with the local Premier Support sales manager. For more information, see the Microsoft Support Lifecycle Policy FAQ.

Severity Ratings and Vulnerability Identifiers

The following severity ratings assume the potential maximum impact of the vulnerability. For information regarding the likelihood, within 30 days of this security bulletin's release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the January bulletin summary. For more information, see Microsoft Exploitability Index.

Vulnerability Severity Rating and Maximum Security Impact by Affected Software
Affected Software Query Filter DoS Vulnerability - CVE-2014-0261 Aggregate Severity Rating
Microsoft Dynamics AX 4.0
Microsoft Dynamics AX 4.0 Service Pack 2 Important  Denial of Service Important
Microsoft Dynamics AX 2009
Microsoft Dynamics AX 2009 Service Pack 1 Important  Denial of Service Important
Microsoft Dynamics AX 2012 and Microsoft Dynamics AX 2012 R2
Microsoft Dynamics AX 2012 Important  Denial of Service Important
Microsoft Dynamics AX 2012 R2 Important  Denial of Service Important

Query Filter DoS Vulnerability - CVE-2014-0261

A denial of service vulnerability exists in Microsoft Dynamics AX that could allow an attacker to cause an AOS instance to become unresponsive.

To view this vulnerability as a standard entry in the Common Vulnerabilities and Exposures list, see CVE-2014-0261.

Mitigating Factors

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

  • To exploit this vulnerability, an attacker must be able to authenticate on the Microsoft Dynamics AX client.

Workarounds

Microsoft has not identified any workarounds for this vulnerability.

FAQ

What is the scope of the vulnerability?
This is a denial of service vulnerability.

What causes the vulnerability?
The vulnerability is caused when Microsoft Dynamics AX does not properly handle user input.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could cause the target AOS instance to stop responding to client requests.

How could an attacker exploit the vulnerability?
An authenticated attacker could submit specially crafted data to an affected AOS instance.

What systems are primarily at risk from the vulnerability?
Servers running affected versions of Microsoft Dynamics AX are primarily at risk from this vulnerability.

What does the update do?
The update addresses the vulnerability by helping to ensure that Microsoft Dynamics AX properly handles data provided by a user.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
No. Microsoft received information about this vulnerability through coordinated vulnerability disclosure.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.

Detection and Deployment Tools and Guidance

These security updates are available from the Microsoft Download Center, Microsoft Dynamics CustomerSource, and Microsoft Dynamics PartnerSource only.

Security Update Deployment

Microsoft Dynamics AX

Reference Table

The following table contains the security update information for this software.

Security update file name For Microsoft Dynamics AX 4.0:\ DynamicsAX4-KB2920510-SP2.EXE
\ For Microsoft Dynamics AX 2009:\ DynamicsAX2009-KB2914058-SP1.EXE
\ For Microsoft Dynamics AX 2012:\ DynamicsAX2012-KB2914055.EXE
\ For Microsoft Dynamics AX 2012 R2:\ DynamicsAX2012R2-KB2914057.EXE
Installation guidance See Microsoft Knowledge Base Article 893082
Restart requirement After you install this update, you must restart the Application Object Server (AOS) service. You may also have to restart your system.\ \ In some cases, this update does not require a system restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.\ \ To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.
Removal information Use Add or Remove Programs item in Control Panel.
File information For Microsoft Dynamics AX 4.0:\ See Microsoft Knowledge Base Article 2920510
\ For Microsoft Dynamics AX 2009:\ See Microsoft Knowledge Base Article 2914058
\ For Microsoft Dynamics AX 2012:\ See Microsoft Knowledge Base Article 2914055
\ For Microsoft Dynamics AX 2012 R2:\ See Microsoft Knowledge Base Article 2914057
Registry key verification Not applicable

Acknowledgments

Microsoft thanks the following for working with us to help protect customers:

  • Andrey Maykov, Lead Developer in FTO Project, for reporting the Query Filter DoS Vulnerability (CVE-2014-0261)

Other Information

Microsoft Active Protections Program (MAPP)

To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please go to the active protections websites provided by program partners, listed in Microsoft Active Protections Program (MAPP) Partners.

Support

How to obtain help and support for this security update

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

  • V1.0 (January 14, 2014): Bulletin published.

Page generated 2014-06-25 13:37Z-07:00.