PT-2015-1528 · Microsoft · Windows 8.1+4

Published 2015-07-14 · Updated 2019-05-08 · CVE-2015-2362

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Hyper-V versions in Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2

Description The issue is caused by a buffer overflow in dynamic memory, allowing a local attacker to execute arbitrary code or cause a denial of service on the host operating system by escalating privileges of the guest operating system. This is achieved by leveraging guest OS privileges to improperly initialize guest OS system data structures.

Recommendations For Microsoft Hyper-V in Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2015-10828

CVE-2015-2362

Affected Products

Hyper-V

Windows 8

Windows 8.1

Windows Server 2008

Windows Server 2012

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-2362 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-068 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10828 · Security Note
• http://securitytracker.com/id/1032897 · Note
• http://technet.microsoft.com/security/bulletin/MS15-068 · Note