PT-2015-4384 · Microsoft · Windows

Published 2015-01-13 · Updated 2018-10-12 · CVE-2015-0001

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the patchday that contains the fix for this issue

Description A security feature bypass issue exists in the Windows Error Reporting (WER) component, allowing administrative users to bypass the Protected Process Light protection mechanism. This enables them to read the contents of arbitrary process-memory locations. An attacker who successfully exploits this issue could access the memory of a running process protected by Protected Process Light. The attacker must have valid logon credentials and be able to log on locally with administrator privileges to exploit this issue.

Recommendations For all affected versions, apply the patch from the patchday that contains the fix for this issue to resolve the security feature bypass vulnerability. As a temporary workaround, consider restricting administrative access to sensitive systems until the patch is applied.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-0001

Affected Products

Windows

References · 9

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-006 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0001 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-0001 · Security Note
• http://packetstormsecurity.com/files/134392/Microsoft-Windows-8.1-Ahcache.sys-NtApphelpCacheControl-Privilege-Escalation.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99514 · Note
• http://secunia.com/advisories/62134 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99513 · Note
• http://securityfocus.com/bid/71927 · Note
• http://technet.microsoft.com/security/bulletin/ms15-006 · Note