CVE-2015-1635

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html	Exploit Third Party Advisory VDB Entry
http://www.osvdb.org/120629	Broken Link
http://www.securityfocus.com/bid/74013	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1032109	Third Party Advisory VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034	Patch Vendor Advisory
https://www.exploit-db.com/exploits/36773/	Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/36776/	Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html	Exploit Third Party Advisory VDB Entry
http://www.osvdb.org/120629	Broken Link
http://www.securityfocus.com/bid/74013	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1032109	Third Party Advisory VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034	Patch Vendor Advisory
https://www.exploit-db.com/exploits/36773/	Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/36776/	Exploit Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:microsoft:windows_7:-:sp1::::::
	cpe:2.3:o:microsoft:windows_8:-:::::::*
	cpe:2.3:o:microsoft:windows_8.1:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::itanium:*
	cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::x64:*
	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*

History

21 Nov 2024, 02:25

Type	Values Removed	Values Added
References	~~() http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html - Exploit, Third Party Advisory, VDB Entry~~	() http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html - Exploit, Third Party Advisory, VDB Entry
References	~~() http://www.osvdb.org/120629 - Broken Link~~	() http://www.osvdb.org/120629 - Broken Link
References	~~() http://www.securityfocus.com/bid/74013 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/74013 - Third Party Advisory, VDB Entry
References	~~() http://www.securitytracker.com/id/1032109 - Third Party Advisory, VDB Entry~~	() http://www.securitytracker.com/id/1032109 - Third Party Advisory, VDB Entry
References	~~() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034 - Patch, Vendor Advisory~~	() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034 - Patch, Vendor Advisory
References	~~() https://www.exploit-db.com/exploits/36773/ - Exploit, Third Party Advisory, VDB Entry~~	() https://www.exploit-db.com/exploits/36773/ - Exploit, Third Party Advisory, VDB Entry
References	~~() https://www.exploit-db.com/exploits/36776/ - Exploit, Third Party Advisory, VDB Entry~~	() https://www.exploit-db.com/exploits/36776/ - Exploit, Third Party Advisory, VDB Entry

Information

Published : 2015-04-14 20:59

Updated : 2024-11-21 02:25

NVD link : CVE-2015-1635

Mitre link : CVE-2015-1635

CVE.ORG link : CVE-2015-1635

JSON object : View

Products Affected

microsoft

windows_server_2008
windows_server_2012
windows_8.1
windows_8
windows_7

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

10.0 /10