PT-2015-2019 · Microsoft · Windows Rt+9
Publicado
2015-09-08
·
Atualizado
2019-05-14
·
CVE-2015-2516
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
Windows Journal versions in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10
Description
The issue is related to insufficient input validation when processing a journal file, which can be exploited by a remote attacker using a specially crafted .jnt file. This can cause a denial of service, resulting in data loss on the target system. The denial of service does not allow an attacker to execute code or elevate their user rights. For an attack to be successful, a user must open a specially crafted Journal file with an affected version of Windows Journal.
Recommendations
For Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10, avoid opening specially crafted Journal files until a patch is available.
As a temporary workaround, consider restricting access to Windows Journal to minimize the risk of exploitation.
Correção
DoS
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Windows
Windows 10
Windows 7
Windows 8
Windows 8.1
Windows Journal
Windows Rt
Windows Server 2008
Windows Server 2012
Windows Vista