Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege



Risk Medium
Patch available YES
Number of vulnerabilities 11
CVE-ID CVE-2015-1719
CVE-2015-1720
CVE-2015-1721
CVE-2015-1722
CVE-2015-1723
CVE-2015-1724
CVE-2015-1725
CVE-2015-1726
CVE-2015-1727
CVE-2015-1768
CVE-2015-2360
CWE-ID CWE-119
CWE-476
Exploitation vector Local
Public exploit Public exploit code for vulnerability #3 is available.
Public exploit code for vulnerability #4 is available.
Public exploit code for vulnerability #5 is available.
Public exploit code for vulnerability #6 is available.
Public exploit code for vulnerability #7 is available.
Public exploit code for vulnerability #8 is available.
Public exploit code for vulnerability #9 is available.
Vulnerability #11 is being exploited in the wild.
Vulnerable software
 Windows
Operating systems & Components / Operating system

Windows Server
Operating systems & Components / Operating system

Vendor Microsoft

Security Bulletin

This security bulletin contains information about 11 vulnerabilities.

1) Memory corruption

EUVDB-ID: #VU5380

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2015-1719

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper handling of buffer elements. A local attacker can run a specially crafted program to request specific memory content and read important data.

Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.

Mitigation

Install updates from Microsoft website.

Vulnerable software versions

Windows: Vista - 8.1

Windows Server: 2003 - 2012

CPE2.3 External links

https://technet.microsoft.com/en-us/library/security/ms15-061


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) “Use-after-free” error

EUVDB-ID: #VU5381

Risk: High

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2015-1720

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to use-after-free error. A local attacker can run a specially crafted program to trigger memory corruption, gain administrative privileges and execute arbitrary code.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Mitigation

Install updates from Microsoft website.

Vulnerable software versions

Windows: Vista - 8.1

Windows Server: 2003 - 2012

CPE2.3 External links

https://technet.microsoft.com/en-us/library/security/ms15-061


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Null pointer dereference

EUVDB-ID: #VU5382

Risk: High

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2015-1721

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: Yes

Description

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to null pointer dereference. A local attacker can run a specially crafted program to gain administrative privileges and execute arbitrary code in kernel mode.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Mitigation

Install updates from Microsoft website.

Vulnerable software versions

Windows: Vista - 8.1

Windows Server: 2003 - 2012

CPE2.3 External links

https://technet.microsoft.com/en-us/library/security/ms15-061


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) “Use-after-free” error

EUVDB-ID: #VU5383

Risk: High

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2015-1722

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to use-after-free error. A local attacker can run a specially crafted program to trigger memory corruption and acquire administrative privileges.

Successful exploitation of the vulnerability results in privilege escalation on the vulnerable system.

Mitigation

Install updates from Microsoft website.

Vulnerable software versions

Windows: Vista - 8.1

Windows Server: 2003 - 2012

CPE2.3 External links

https://technet.microsoft.com/en-us/library/security/ms15-061


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

5) “Use-after-free” error

EUVDB-ID: #VU5384

Risk: High

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2015-1723

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to use-after-free error. A local attacker can run a specially crafted program to trigger memory corruption and acquire administrative privileges.

Successful exploitation of the vulnerability results in privilege escalation on the vulnerable system.

Mitigation

Install updates from Microsoft website.

Vulnerable software versions

Windows: Vista - 8.1

Windows Server: 2003 - 2012

CPE2.3 External links

https://technet.microsoft.com/en-us/library/security/ms15-061


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

6) “Use-after-free” error

EUVDB-ID: #VU5385

Risk: High

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2015-1724

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to use-after-free error. A local attacker can run a specially crafted program to trigger memory corruption and acquire administrative privileges.

Successful exploitation of the vulnerability results in privilege escalation on the vulnerable system.

Mitigation

Install updates from Microsoft website.

Vulnerable software versions

Windows: Vista - 8.1

Windows Server: 2003 - 2012

CPE2.3 External links

https://technet.microsoft.com/en-us/library/security/ms15-061


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

7) Buffer overflow

EUVDB-ID: #VU5386

Risk: High

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2015-1725

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to buffer overflow. A local attacker can run a specially crafted program to trigger memory corruption and acquire administrative privileges.

Successful exploitation of the vulnerability results in privilege escalation on the vulnerable system.

Mitigation

Install updates from Microsoft website.

Vulnerable software versions

Windows: Vista - 8.1

Windows Server: 2003 - 2012

CPE2.3 External links

https://technet.microsoft.com/en-us/library/security/ms15-061


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

8) “Use-after-free” error

EUVDB-ID: #VU5389

Risk: High

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2015-1726

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to use-after-free error. A local attacker can run a specially crafted program to trigger memory corruption and acquire administrative privileges.

Successful exploitation of the vulnerability results in privilege escalation on the vulnerable system.

Mitigation

Install updates from Microsoft website.

Vulnerable software versions

Windows: Vista - 8.1

Windows Server: 2003 - 2012

CPE2.3 External links

https://technet.microsoft.com/en-us/library/security/ms15-061


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

9) Buffer overflow

EUVDB-ID: #VU5390

Risk: High

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2015-1727

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to buffer overflow. A local attacker can run a specially crafted program to trigger memory corruption and acquire administrative privileges.

Successful exploitation of the vulnerability results in privilege escalation on the vulnerable system.

Mitigation

Install updates from Microsoft website.

Vulnerable software versions

Windows: Vista - 8.1

Windows Server: 2003 - 2012

CPE2.3 External links

https://technet.microsoft.com/en-us/library/security/ms15-061


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

10) Memory corruption

EUVDB-ID: #VU5391

Risk: High

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2015-1768

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to boundary error. A local attacker can run a specially crafted program to trigger memory corruption and acquire administrative privileges.

Successful exploitation of the vulnerability results in privilege escalation on the vulnerable system.

Mitigation

Install updates from Microsoft website.

Vulnerable software versions

Windows Server: 2003

CPE2.3
External links

https://technet.microsoft.com/en-us/library/security/ms15-061


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Memory corruption

EUVDB-ID: #VU5392

Risk: Medium

CVSSv4.0: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Green]

CVE-ID: CVE-2015-2360

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to boundary error. A local attacker can run a specially crafted program to trigger memory corruption and acquire administrative privileges.

Successful exploitation of the vulnerability results in privilege escalation on the vulnerable system.

Note: the vulnerability was being actively exploited.

Mitigation

Install updates from Microsoft website.

Vulnerable software versions

Windows: Vista - 8.1

Windows Server: 2003 - 2012

CPE2.3 External links

https://technet.microsoft.com/en-us/library/security/ms15-061


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.



###SIDEBAR###