PT-2015-1065 · Microsoft · Task Scheduler+3

Published 2015-04-14 · Updated 2018-10-12 · CVE-2015-0098

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows 7 SP1 Microsoft Windows Server 2008 R2 SP1

Description The issue allows local users to gain privileges by triggering application execution by an invalid task. An attacker who successfully exploits this could cause the Task Scheduler to run a specially crafted application in the context of the System account. This could enable the attacker to install programs, view, change, or delete data, or create new accounts with full user rights. To exploit the issue, an attacker would first have to log on to the target system and determine whether or not the known invalid task was present on the system.

Recommendations For Microsoft Windows 7 SP1, update the system to remove the known invalid task that allows for privilege escalation. For Microsoft Windows Server 2008 R2 SP1, ensure that all users log on to the system with limited privileges to minimize the risk of exploitation, and apply any available patches to fix the Task Scheduler elevation of privilege issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-09925

CVE-2015-0098

Affected Products

Windows 7 Sp1

Windows Server 2008 R2 Sp1

Task Scheduler

Windows

References · 6

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-037 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0098 · Security Note
• https://bdu.fstec.ru/vul/2015-09925 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0098 · Security Note
• http://technet.microsoft.com/security/bulletin/ms15-037 · Note
• http://securitytracker.com/id/1032112 · Note