CVE-2015-0015

Microsoft Windows Server 2003 SP2, Server 2008 SP2 and R2 SP1, and Server 2012 Gold and R2 allow remote attackers to cause a denial of service (system hang and RADIUS outage) via crafted username strings to (1) Internet Authentication Service (IAS) or (2) Network Policy Server (NPS), aka "Network Policy Server RADIUS Implementation Denial of Service Vulnerability."

CVSS v2.0 7.8 HIGH

7.8^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
http://secunia.com/advisories/62148
http://www.securityfocus.com/bid/71933
http://www.securitytracker.com/id/1031532
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-007
http://secunia.com/advisories/62148
http://www.securityfocus.com/bid/71933
http://www.securitytracker.com/id/1031532
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-007

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
	cpe:2.3:o:microsoft:windows_server_2008:-:sp2::::::
	cpe:2.3:o:microsoft:windows_server_2008:r2:sp1::::::
	cpe:2.3:o:microsoft:windows_server_2012:-:gold::::::
	cpe:2.3:o:microsoft:windows_server_2012:r2:::::x64::

History

21 Nov 2024, 02:22

Type	Values Removed	Values Added
References	~~() http://secunia.com/advisories/62148 -~~	() http://secunia.com/advisories/62148 -
References	~~() http://www.securityfocus.com/bid/71933 -~~	() http://www.securityfocus.com/bid/71933 -
References	~~() http://www.securitytracker.com/id/1031532 -~~	() http://www.securitytracker.com/id/1031532 -
References	~~() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-007 -~~	() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-007 -

Information

Published : 2015-01-13 22:59

Updated : 2024-11-21 02:22

NVD link : CVE-2015-0015

Mitre link : CVE-2015-0015

CVE.ORG link : CVE-2015-0015

JSON object : View

Products Affected

microsoft

windows_server_2003
windows_server_2008
windows_server_2012

CWE

CWE-399

Resource Management Errors

{"id": "CVE-2015-0015", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-01-13T22:59:06.363", "references": [{"url": "http://secunia.com/advisories/62148", "source": "secure@microsoft.com"}, {"url": "http://www.securityfocus.com/bid/71933", "source": "secure@microsoft.com"}, {"url": "http://www.securitytracker.com/id/1031532", "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-007", "source": "secure@microsoft.com"}, {"url": "http://secunia.com/advisories/62148", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/71933", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1031532", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-007", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-399"}]}], "descriptions": [{"lang": "en", "value": "Microsoft Windows Server 2003 SP2, Server 2008 SP2 and R2 SP1, and Server 2012 Gold and R2 allow remote attackers to cause a denial of service (system hang and RADIUS outage) via crafted username strings to (1) Internet Authentication Service (IAS) or (2) Network Policy Server (NPS), aka \"Network Policy Server RADIUS Implementation Denial of Service Vulnerability.\""}, {"lang": "es", "value": "Microsoft Windows Server 2003 SP2, Server 2008 SP2 y R2 SP1, y Server 2012 Gold y R2 permiten a atacantes remotos causar una denegaci\u00f3n de servicio (cuelgue de sistema y interrupci\u00f3n de RADIUS) a trav\u00e9s de cadenas de nombres de usuarios manipuladas en (1) Internet Authentication Service (IAS) o (2) Network Policy Server (NPS), tambi\u00e9n conocido como 'vulnerabilidad de la denegaci\u00f3n de servicio de la implementaci\u00f3n RADIUS del servidor de la pol\u00edtica de red.'"}], "lastModified": "2024-11-21T02:22:11.340", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D3B5E4F-56A6-4696-BBB4-19DF3613D020"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F422A8C-2C4E-42C8-B420-E0728037E15C"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2ACA9287-B475-4AF7-A4DA-A7143CEF9E57"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:gold:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB506484-7F0C-46BF-8EA6-4FB5AF454CED"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:x64:*:*", "vulnerable": true, "matchCriteriaId": "D29A1464-D228-4E0D-8FEA-06B9CBCA7F74"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}