PT-2015-4468 · Microsoft · Windows 8.1+8

Published 2015-03-10 · Updated 2023-01-20 · CVE-2015-0096

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2003 SP2 Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2 and R2 SP1 Microsoft Windows 7 SP1 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Gold and R2 Microsoft Windows RT Gold and 8.1

Description A remote code execution issue exists due to improper handling of DLL files by Microsoft Windows, allowing an attacker to gain complete control of an affected system. This could enable the installation of programs, viewing, changing, or deleting data, or creating new accounts with full user rights. The issue can be exploited via a Trojan horse DLL in the current working directory, leading to DLL loading during Windows Explorer access to the icon of a crafted shortcut.

Recommendations For Microsoft Windows Server 2003 SP2, apply the official fix. For Microsoft Windows Vista SP2, apply the official fix. For Microsoft Windows Server 2008 SP2 and R2 SP1, apply the official fix. For Microsoft Windows 7 SP1, apply the official fix. For Microsoft Windows 8, apply the official fix. For Microsoft Windows 8.1, apply the official fix. For Microsoft Windows Server 2012 Gold and R2, apply the official fix. For Microsoft Windows RT Gold and 8.1, apply the official fix.

Exploit

Fix

RCE

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2015-0096

ZDI-15-086

Affected Products

Windows

Windows 7

Windows 8

Windows 8.1

Windows Rt

Windows Server 2003

Windows Server 2008

Windows Server 2012

Windows Vista

References · 12

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/ms15_020_shortcut_icon_dllloader.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms15_020_shortcut_icon_dllloader.rb · Exploit
• 🔥 https://exploit-db.com/exploits/14403 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0096 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-0096 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-020 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-15-086 · Security Note
• https://github.com/EricZimmerman/LECmd · Note
• http://securitytracker.com/id/1031890 · Note
• http://securityfocus.com/bid/72894 · Note
• https://t.me/aptreports/2500 · Telegram Post
• http://technet.microsoft.com/security/bulletin/ms15-020 · Note