PT-2015-5742 · Microsoft · Windows

Ashutosh Mehra · Publicado 2015-08-11 · Atualizado 2019-05-15 · CVE-2015-2430

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue allows attackers to bypass an application sandbox protection mechanism and perform unspecified filesystem actions via a crafted application. An elevation of privilege exists in Microsoft Windows when it improperly allows certain filesystem interactions from within vulnerable sandboxed applications. An attacker who successfully exploited this issue could improperly interact with the filesystem and attempt to escape the application sandbox. To exploit the issue, an attacker would have to convince the user to open a specially crafted file.

Recommendations For Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-2430

ZDI-15-378

Produtos afetados

Windows

Referências · 8

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-090 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-2430 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/ms15-090 · Nota
• https://zerodayinitiative.com/advisories/ZDI-15-378 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-15-378 · Nota
• http://securityfocus.com/bid/76233 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2430 · Nota de Segurança
• http://securitytracker.com/id/1033251 · Nota