PT-2015-4384 · Microsoft · Windows

Publicado 2015-01-13 · Atualizado 2018-10-12 · CVE-2015-0001

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the patchday that contains the fix for this issue

Description A security feature bypass issue exists in the Windows Error Reporting (WER) component, allowing administrative users to bypass the Protected Process Light protection mechanism. This enables them to read the contents of arbitrary process-memory locations. An attacker who successfully exploits this issue could access the memory of a running process protected by Protected Process Light. The attacker must have valid logon credentials and be able to log on locally with administrator privileges to exploit this issue.

Recommendations For all affected versions, apply the patch from the patchday that contains the fix for this issue to resolve the security feature bypass vulnerability. As a temporary workaround, consider restricting administrative access to sensitive systems until the patch is applied.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-0001

Produtos afetados

Windows

Referências · 9

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-006 · Aviso do Fabricante
• http://packetstormsecurity.com/files/134392/Microsoft-Windows-8.1-Ahcache.sys-NtApphelpCacheControl-Privilege-Escalation.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99514 · Nota
• http://secunia.com/advisories/62134 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0001 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99513 · Nota
• http://securityfocus.com/bid/71927 · Nota
• http://technet.microsoft.com/security/bulletin/ms15-006 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-0001 · Nota de Segurança