PT-2015-4385 · Microsoft · Windows+2

Forshaw · Published 2015-01-13 · Updated 2018-10-12 · CVE-2015-0002

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue is related to the improper verification of an impersonation token's association with an administrative account by the AhcVerifyAdminContext function in the Application Compatibility component. This allows local users to gain privileges by running AppCompatCache.exe with a crafted DLL file. An elevation of privilege vulnerability exists in how the Microsoft Windows Application Compatibility Infrastructure (AppCompat) improperly checks the authorization of the caller's impersonation token, which could be exploited by an attacker to run a privileged application.

Recommendations For Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-0002

Affected Products

Appcompatcache.Exe

Application Compatibility Infrastructure

Windows

References · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ntapphelpcachecontrol.rb · Exploit
• 🔥 https://exploit-db.com/exploits/35661 · Exploit
• 🔥 https://code.google.com/p/google-security-research/issues/detail?id=118 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0002 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0002 · Security Note
• http://technet.microsoft.com/security/bulletin/ms15-001 · Note
• http://secunia.com/advisories/61277 · Note
• http://securityfocus.com/bid/71972 · Note
• http://twitter.com/sambowne/statuses/550384131683520512 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99524 · Note
• http://zdnet.com/article/google-discloses-unpatched-windows-vulnerability · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99523 · Note