CVE-2015-1635

Опубликовано: 14 апр. 2015

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Критический

Описание

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."

Ссылки

http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html
Exploit
Third Party Advisory
VDB Entry
http://www.osvdb.org/120629
Broken Link
http://www.securityfocus.com/bid/74013
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1032109
Third Party Advisory
VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034
Patch
Vendor Advisory
https://www.exploit-db.com/exploits/36773/
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/36776/
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html
Exploit
Third Party Advisory
VDB Entry
http://www.osvdb.org/120629
Broken Link
http://www.securityfocus.com/bid/74013
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1032109
Third Party Advisory
VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034
Patch
Vendor Advisory
https://www.exploit-db.com/exploits/36773/
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/36776/
Exploit
Third Party Advisory
VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1635

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*

cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.9431

Критический

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-94

Связанные уязвимости

GHSA-p8wc-6g47-vh8j

CVSS3: 9.8

github

больше 3 лет назад

BDU:2015-09906

fstec

почти 11 лет назад

Уязвимость операционной системы Windows, позволяющая удалённому злоумышленнику выполнить произвольный код в контексте системной учётной записи