PT-2015-2747 · Nvidia · Nvidia Gpu Graphics Driver

James Forshaw · Publicado 2015-11-24 · Atualizado 2019-02-13 · CVE-2015-7865

Positive Technologies (AI Summary)

CVSS v2.0

7.7

Alta

Vetor base

AV:A/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NVIDIA GPU graphics driver versions R340 through 341.92 NVIDIA GPU graphics driver versions R352 through 354.35 NVIDIA GPU graphics driver versions R358 through 358.87

Description The issue is related to insufficient access control in the nvSCPAPISvr.exe file of the Stereoscopic 3D Driver Service component. Exploitation of this issue can allow a local attacker to elevate privileges using the command line, leveraging registry keys stored in HKEY LOCAL MACHINE.

Recommendations For versions R340 through 341.92, update to version 341.92 or later. For versions R352 through 354.35, update to version 354.35 or later. For versions R358 through 358.87, update to version 358.87 or later.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2015-12112

CVE-2015-7865

Produtos afetados

Nvidia Gpu Graphics Driver

Referências · 8

• 🔥 https://code.google.com/p/google-security-research/issues/detail?id=515 · Exploit
• 🔥 https://exploit-db.com/exploits/38792 · Exploit
• http://nvidia.custhelp.com/app/answers/detail/a_id/3807/kw/security · Aviso do Fabricante
• http://securitytracker.com/id/1034173 · Nota
• http://packetstormsecurity.com/files/134520/NVIDIA-Stereoscopic-3D-Driver-Service-Arbitrary-Run-Key-Creation.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7865 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-12112 · Nota de Segurança
• https://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04971867 · Aviso do Fabricante