PT-2015-5417 · Microsoft · Windows 8+7

4B5F5F4B · Published 2015-05-12 · Updated 2019-05-14 · CVE-2015-1674

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 8 through 8.1 Microsoft Windows Server versions 2012 Gold and R2 Microsoft Windows RT versions Gold and 8.1

Description A security feature bypass issue exists due to the Windows kernel's failure to properly validate a memory address. This allows an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (KASLR) bypass, enabling them to discover the cng.sys base address from a compromised process. To exploit this, an attacker must log on to an affected system.

Recommendations For Microsoft Windows versions 8 through 8.1, update to a version that includes the security fix for this issue. For Microsoft Windows Server versions 2012 Gold and R2, apply the necessary patch or update to resolve the security feature bypass vulnerability. For Microsoft Windows RT versions Gold and 8.1, install the available security update that addresses this vulnerability.

Exploit

Fix

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2015-1674

ZDI-15-189

Affected Products

Windows

Windows 8

Windows 8.1

Windows Rt

Windows Rt 8.1

Windows Server 2012

Windows Server 2012 R2

Cng.Sys

References · 8

• 🔥 https://exploit-db.com/exploits/37052 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1674 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-052 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-15-189 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-1674 · Security Note
• http://securityfocus.com/bid/74488 · Note
• http://technet.microsoft.com/security/bulletin/ms15-052 · Note
• http://securitytracker.com/id/1032292 · Note