PT-2015-5417 · Microsoft · Windows 8+7

4B5F5F4B · Publicado 2015-05-12 · Atualizado 2019-05-14 · CVE-2015-1674

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 8 through 8.1 Microsoft Windows Server versions 2012 Gold and R2 Microsoft Windows RT versions Gold and 8.1

Description A security feature bypass issue exists due to the Windows kernel's failure to properly validate a memory address. This allows an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (KASLR) bypass, enabling them to discover the cng.sys base address from a compromised process. To exploit this, an attacker must log on to an affected system.

Recommendations For Microsoft Windows versions 8 through 8.1, update to a version that includes the security fix for this issue. For Microsoft Windows Server versions 2012 Gold and R2, apply the necessary patch or update to resolve the security feature bypass vulnerability. For Microsoft Windows RT versions Gold and 8.1, install the available security update that addresses this vulnerability.

Exploit

Correção

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

CVE-2015-1674

ZDI-15-189

Produtos afetados

Windows

Windows 8

Windows 8.1

Windows Rt

Windows Rt 8.1

Windows Server 2012

Windows Server 2012 R2

Cng.Sys

Referências · 8

• 🔥 https://exploit-db.com/exploits/37052 · Exploit
• http://securityfocus.com/bid/74488 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1674 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-052 · Aviso do Fabricante
• http://technet.microsoft.com/security/bulletin/ms15-052 · Nota
• http://securitytracker.com/id/1032292 · Nota
• https://zerodayinitiative.com/advisories/ZDI-15-189 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2015-1674 · Nota de Segurança