PT-2015-2683 · Microsoft · Windows Vista+4
Nils Sommer
·
Publicado
2015-11-10
·
Atualizado
2018-10-12
·
CVE-2015-6098
CVSS v2.0
7.2
Alta
| Vetor | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft Windows Vista SP2
Microsoft Windows Server 2008 SP2 and R2 SP1
Microsoft Windows 7 SP1
Description
The issue is caused by a buffer overflow in the Network Driver Interface Standard (NDIS) implementation, allowing local users to gain privileges via a crafted application. An elevation of privilege vulnerability exists when NDIS fails to check the length of a buffer prior to copying memory into it. To exploit the vulnerability, an attacker would first have to log on to the system.
Recommendations
For Microsoft Windows Vista SP2, update to a newer version that contains a fix for this issue.
For Microsoft Windows Server 2008 SP2 and R2 SP1, update to a newer version that contains a fix for this issue.
For Microsoft Windows 7 SP1, update to a newer version that contains a fix for this issue.
As a temporary workaround, consider restricting access to the NDIS implementation until a patch is available.
Exploit
Correção
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Ndis
Windows
Windows 7
Windows Server 2008
Windows Vista