PT-2015-2953 · Microsoft · Windows 7+3

Publicado 2015-12-08 · Atualizado 2018-10-12 · CVE-2015-6130

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue is caused by an integer underflow in Uniscribe, allowing remote attackers to execute arbitrary code via a crafted font. A remote code execution vulnerability exists when Windows Uniscribe improperly parses specially crafted fonts. An attacker who successfully exploited the issue could install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1, update to a version that includes the fix for the integer underflow in Uniscribe. For other affected versions of Microsoft Windows, apply the necessary patch or update to resolve the remote code execution vulnerability. As a temporary workaround, consider restricting the use of specially crafted fonts to minimize the risk of exploitation.

Exploit

Correção

RCE

Integer Underflow

Enumeração de Fraquezas

CWE-189

CWE-191

Identificadores relacionados

BDU:2016-00050

CVE-2015-6130

Produtos afetados

Uniscribe

Windows

Windows 7

Windows Server 2008 R2

Referências · 8

• 🔥 http://blogs.flexerasoftware.com/secunia-research/2015/12/vulnerability-in-microsofts-unicode-scripts-processor-allows-execution-of-arbitrary-code.html · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-130 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-00050 · Nota de Segurança
• http://securitytracker.com/id/1034337 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6130 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2015-6130 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/ms15-130 · Nota
• http://technet.microsoft.com/security/bulletin/MS15-130 · Nota