PT-2015-4452 · Microsoft · Windows Rt+4

Published 2015-03-10 · Updated 2019-05-14 · CVE-2015-0078

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows 8 versions 8 through 8.1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT Gold and 8.1

Description The issue is caused by the Windows kernel-mode driver's failure to properly validate the calling thread's token, allowing local users to gain privileges via a crafted application. An authenticated attacker who successfully exploits this issue could acquire administrator credentials and use them to elevate privileges, enabling the installation of programs, viewing, changing, or deleting data, or creating new accounts with full administrative rights. To exploit the issue, an attacker would first have to log on to the system.

Recommendations For Windows 8, update to a version that properly validates the token of a calling thread. For Windows 8.1, apply the necessary patch to fix the kernel-mode driver's validation issue. For Windows Server 2012 Gold and R2, ensure the kernel-mode driver is updated to correctly validate the calling thread's token. For Windows RT Gold and 8.1, apply the relevant security update to address the elevation of privilege vulnerability.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-0078

Affected Products

Windows

Windows 8

Windows 8.1

Windows Rt

Windows Server 2012

References · 6

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0078 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0078 · Security Note
• http://securitytracker.com/id/1031897 · Note
• http://securityfocus.com/bid/72902 · Note
• http://technet.microsoft.com/security/bulletin/ms15-023 · Note