PT-2015-2951 · Microsoft · Windows 8.1+8

Published 2015-12-08 · Updated 2019-05-15 · CVE-2015-6132

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2 and R2 SP1 Microsoft Windows 7 SP1 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Gold and R2 Microsoft Windows RT Gold and 8.1 Microsoft Windows 10 Gold and 1511

Description The issue is related to the improper handling of library loading, which allows local users to gain privileges via a crafted application. This can lead to remote code execution, enabling an attacker to take complete control of an affected system. The attacker could then install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than those operating with administrative user rights.

Recommendations For Microsoft Windows Vista SP2, update to a newer version to mitigate the risk. For Microsoft Windows Server 2008 SP2 and R2 SP1, update to a newer version to mitigate the risk. For Microsoft Windows 7 SP1, update to a newer version to mitigate the risk. For Microsoft Windows 8, update to a newer version to mitigate the risk. For Microsoft Windows 8.1, update to a newer version to mitigate the risk. For Microsoft Windows Server 2012 Gold and R2, update to a newer version to mitigate the risk. For Microsoft Windows RT Gold and 8.1, update to a newer version to mitigate the risk. For Microsoft Windows 10 Gold and 1511, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting the use of crafted applications that could exploit the library loading issue until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2016-00048

CVE-2015-6132

Affected Products

Windows

Windows 10

Windows 7

Windows 8

Windows 8.1

Windows Rt

Windows Server 2008

Windows Server 2012

Windows Vista

References · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/office_ole_multiple_dll_hijack.rb · Exploit
• 🔥 https://github.com/hexx0r/CVE-2015-6132 · Exploit
• 🔥 https://exploit-db.com/exploits/38968 · Exploit
• 🔥 https://exploit-db.com/exploits/41706 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-132 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6132 · Security Note
• https://bdu.fstec.ru/vul/2016-00048 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6132 · Security Note
• http://technet.microsoft.com/security/bulletin/MS15-132 · Note
• http://securitytracker.com/id/1034338 · Note
• http://technet.microsoft.com/security/bulletin/ms15-132 · Note