CVE-2015-2361

Hyper-V in Microsoft Windows 8.1 and Windows Server 2012 R2 does not properly initialize guest OS system data structures, which allows guest OS users to execute arbitrary code on the host OS or cause a denial of service (buffer overflow) by leveraging guest OS privileges, aka "Hyper-V Buffer Overflow Vulnerability."

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.securitytracker.com/id/1032897
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-068

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:microsoft:windows_8.1:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:r2::::datacenter:::
	cpe:2.3:o:microsoft:windows_server_2012:r2::::essentials:::
	cpe:2.3:o:microsoft:windows_server_2012:r2::::standard:::

History

No history.

Information

Published : 2015-07-14 21:59

Updated : 2024-02-28 15:21

NVD link : CVE-2015-2361

Mitre link : CVE-2015-2361

CVE.ORG link : CVE-2015-2361

JSON object : View

Products Affected

microsoft

windows_server_2012
windows_8.1

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

{"id": "CVE-2015-2361", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-07-14T21:59:03.923", "references": [{"url": "http://www.securitytracker.com/id/1032897", "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-068", "source": "secure@microsoft.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "Hyper-V in Microsoft Windows 8.1 and Windows Server 2012 R2 does not properly initialize guest OS system data structures, which allows guest OS users to execute arbitrary code on the host OS or cause a denial of service (buffer overflow) by leveraging guest OS privileges, aka \"Hyper-V Buffer Overflow Vulnerability.\""}, {"lang": "es", "value": "Hyper-V en Microsoft Windows 8.1 y Windows Server 2012 R2, no inicializan adecuadamente las estructuras de datos del sistema de invitados del SO, lo que permite a usuarios invitados del SO a ejecutar c\u00f3digo arbitrario en los hu\u00e9spedes del SO o causar una denegaci\u00f3n de servicio mediante el desbordamiento de buffer a trav\u00e9s del aprovechamiento de los privilegios de invitado del SO, error conocido como 'Hyper-V Buffer Overflow Vulnerability.'"}], "lastModified": "2019-05-08T22:03:15.720", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E93068DB-549B-45AB-8E5C-00EB5D8B5CF8"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:datacenter:*:*:*", "vulnerable": true, "matchCriteriaId": "32BCD530-F6E2-4F9B-AD4C-7DF2BED00296"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:essentials:*:*:*", "vulnerable": true, "matchCriteriaId": "A1318333-EF3A-4DBA-8DD7-367BF843F70D"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:standard:*:*:*", "vulnerable": true, "matchCriteriaId": "74B5E7C1-6C1D-4605-91CF-AF105EFA678D"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}