Vulnerabilities > CVE-2015-0010 - Cryptographic Issues vulnerability in Microsoft products
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
The CryptProtectMemory function in cng.sys (aka the Cryptography Next Generation driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1, when the CRYPTPROTECTMEMORY_SAME_LOGON option is used, does not check an impersonation token's level, which allows local users to bypass intended decryption restrictions by leveraging a service that (1) has a named-pipe planting vulnerability or (2) uses world-readable shared memory for encrypted data, aka "CNG Security Feature Bypass Vulnerability" or MSRC ID 20707.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Signature Spoofing by Key Recreation An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Exploit-Db
| description | Microsoft Windows - Local Privilege Escalation (MS15-010). CVE-2015-0003,CVE-2015-0010,CVE-2015-0057,CVE-2015-0058,CVE-2015-0059,CVE-2015-0060. Local exploit... |
| id | EDB-ID:37098 |
| last seen | 2016-02-04 |
| modified | 2015-05-25 |
| published | 2015-05-25 |
| reporter | Sky lake |
| source | https://www.exploit-db.com/download/37098/ |
| title | Microsoft Windows - Local Privilege Escalation MS15-010 |
Msbulletin
| bulletin_id | MS15-010 |
| bulletin_url | |
| date | 2015-02-10T00:00:00 |
| impact | Remote Code Execution |
| knowledgebase_id | 3036220 |
| knowledgebase_url | |
| severity | Critical |
| title | Vulnerabilities in Windows Kernel-Mode Driver Could Allow Remote Code Execution |
Nessus
| NASL family | Windows : Microsoft Bulletins |
| NASL id | SMB_NT_MS15-010.NASL |
| description | The remote Windows host is missing a security patch. It is, therefore, affected by the following vulnerabilities : - A privilege escalation vulnerability exists in the Windows kernel-mode driver that is caused by improperly handling objects in memory. (CVE-2015-0003, CVE-2015-0057) - A security feature bypass vulnerability exists in the Cryptography Next Generation kernel-mode driver when failing to properly validate and enforce impersonation levels. (CVE-2015-0010) - A privilege escalation vulnerability exists in the Windows kernel-mode driver due to a double-free condition. (CVE-2015-0058) - A remote code execution vulnerability exists in the Windows kernel-mode driver that is caused when improperly handling TrueType fonts. (CVE-2015-0059) - A denial of service vulnerability exists in the Windows kernel-mode driver that is caused when the Windows font mapper attempts to scale a font. (CVE-2015-0060) |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 81263 |
| published | 2015-02-10 |
| reporter | This script is Copyright (C) 2015-2018 Tenable Network Security, Inc. |
| source | https://www.tenable.com/plugins/nessus/81263 |
| title | MS15-010: Vulnerabilities in Windows Kernel-Mode Driver Could Allow Remote Code Execution (3036220) |
| code | |
References
- http://code.google.com/p/google-security-research/issues/detail?id=128
- http://code.google.com/p/google-security-research/issues/detail?id=128
- http://www.securityfocus.com/bid/72461
- http://www.securityfocus.com/bid/72461
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-010
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-010