CVE-2015-2552

Опубликовано: 14 окт. 2015

Источник: nvd

CVSS2: 7.2

EPSS Низкий

Описание

The kernel in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows physically proximate attackers to bypass the Trusted Boot protection mechanism, and consequently interfere with the integrity of code, BitLocker, Device Encryption, and Device Health Attestation, via a crafted Boot Configuration Data (BCD) setting, aka "Trusted Boot Security Feature Bypass Vulnerability."

Ссылки

http://packetstormsecurity.com/files/133962/Microsoft-Trusted-Boot-Security-Feature-Bypass.html
Exploit
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/536678/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1033805
Third Party Advisory
VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-111
Patch
Vendor Advisory
http://packetstormsecurity.com/files/133962/Microsoft-Trusted-Boot-Security-Feature-Bypass.html
Exploit
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/536678/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1033805
Third Party Advisory
VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-111
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*

cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*

EPSS

Процентиль: 80%

0.01455

Низкий

7.2 High

CVSS2

Дефекты

CWE-254

Связанные уязвимости

GHSA-mphq-mc55-vc9w

github

больше 3 лет назад

BDU:2015-11688

fstec

больше 10 лет назад

Уязвимость операционной системы Windows, позволяющая нарушителю обойти защитный механизм доверенной загрузки