PT-2015-2322 · Microsoft · Windows 10+7

Published 2015-10-14 · Updated 2019-05-15 · CVE-2015-2550

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT Gold and 8.1 Windows 10

Description The issue is related to insufficient access restrictions to certain functions in the Windows kernel, allowing local users to gain privileges via a crafted application. This can enable an attacker to elevate their privileges.

Recommendations For Windows Vista SP2, update to a newer version to mitigate the risk. For Windows Server 2008 SP2 and R2 SP1, update to a newer version to mitigate the risk. For Windows 7 SP1, update to a newer version to mitigate the risk. For Windows 8, update to a newer version to mitigate the risk. For Windows 8.1, update to a newer version to mitigate the risk. For Windows Server 2012 Gold and R2, update to a newer version to mitigate the risk. For Windows RT Gold and 8.1, update to a newer version to mitigate the risk. For Windows 10, update to a newer version to mitigate the risk.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-11687

CVE-2015-2550

Affected Products

Windows 10

Windows 7

Windows 8

Windows 8.1

Windows Rt

Windows Server 2008

Windows Server 2012

Windows Vista

References · 5

• https://bdu.fstec.ru/vul/2015-11687 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-111 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2550 · Security Note
• http://securitytracker.com/id/1033805 · Note
• http://technet.microsoft.com/security/bulletin/MS15-111 · Note