PT-2015-4456 · Microsoft · Windows Rt+6

Published 2015-03-10 · Updated 2019-05-14 · CVE-2015-0084

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows 7 SP1 Microsoft Windows Server 2008 R2 SP1 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Gold and R2 Microsoft Windows RT Gold and 8.1

Description A security issue exists where the Task Scheduler in Microsoft Windows does not properly constrain impersonation levels. This allows local users to bypass intended restrictions on launching executable files via a crafted task. The vulnerability could allow a user with limited privileges on an affected system to leverage Task Scheduler to execute files that they do not have permissions to run, potentially bypassing ACL checks and running privileged executables.

Recommendations For Microsoft Windows 7 SP1, update the system to apply the necessary security patches. For Microsoft Windows Server 2008 R2 SP1, apply the recommended security updates. For Microsoft Windows 8, install the latest security fixes. For Microsoft Windows 8.1, update the system with the available patches. For Microsoft Windows Server 2012 Gold and R2, apply the security updates to resolve the issue. For Microsoft Windows RT Gold and 8.1, install the necessary security patches.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2015-0084

Affected Products

Windows

Windows 7

Windows 8

Windows 8.1

Windows Rt

Windows Server 2008 R2

Windows Server 2012

References · 6

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0084 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-0084 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-028 · Vendor Advisory
• http://technet.microsoft.com/security/bulletin/ms15-028 · Note
• http://securitytracker.com/id/1031893 · Note
• http://securityfocus.com/bid/72913 · Note