| VID |
26737 |
| Severity |
40 |
| Port |
139,445 |
| Protocol |
TCP |
| Class |
SMB |
| Detailed Description |
The Hotfix (MS15-115, 3105864) for 'Security Update for Windows Kernel to Address Elevation of Privilege' has not been applied.
This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an attacker convinces a user to open a specially crafted document or to visit an untrusted webpage that contains embedded fonts.
Multiple Windows Kernel Memory Elevation of Privilege Vulnerabilities
Multiple elevation of privilege vulnerabilities exist in the way that Windows handles objects in memory. An attacker who successfully exploited the vulnerabilities could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
Multiple Windows Kernel Memory Information Disclosure Vulnerabilities
Multiple information disclosure vulnerabilities exist when Windows fails to properly initialize memory addresses, allowing an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (KASLR) bypass. An attacker who successfully exploited the vulnerabilities could retrieve the base address of the Kernel driver from a compromised process.
Multiple Windows Graphics Memory Remote Code Execution Vulnerabilities
Multiple remote code execution vulnerabilities exist when the Adobe Type Manager Library in Windows improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerabilities could install programs; view, change, or delete data; or create new accounts with full user rights.
Windows Kernel Security Feature Bypass Vulnerability - CVE-2015-6113
A security feature bypass vulnerability exists when the Windows kernel fails to properly validate permissions, allowing an attacker to inappropriately interact with the filesystem from low integrity level user-mode applications. An attacker who successfully exploited this vulnerability could potentially modify files outside a low integrity level application.
* Note: This check requires an account with administrative privileges which can log into the host to scan. Absence of this condition will result in the check not being performed and a False Negative for all vulnerable hosts.
* References:
https://technet.microsoft.com/en-us/library/security/ms15-115
* Platforms Affected:
Windows Vista SP2
Windows Vista x64 SP2
Windows Server 2008 SP2
Windows Server 2008 x64 SP2
Windows 7 SP1
Windows 7 x64 SP1
Windows Server 2008 R2 SP1
Windows Server 2008 R2 x64 SP1
Windows 8
Windows 8.1
Windows Server 2012
Windows Server 2012 R2
Windows 10 |
| Recommendation |
Apply the appropriate patch(3105864) for your system, as listed in Microsoft Security Bulletin MS15-115 at https://technet.microsoft.com/en-us/library/security/ms15-115
-- OR --
Patches for Windows platforms are also available from the Microsoft Windows Update Web site, http://windowsupdate.microsoft.com. Windows Update detects what version of Windows you are running and offers the appropriate patch. |
| Related URL |
CVE-2015-6100,CVE-2015-6101,CVE-2015-6102,CVE-2015-6103,CVE-2015-6104,CVE-2015-6109,CVE-2015-6113 (CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
(ISS) |
|
