HIGH Microsoft Corporation Vulnerability Alert

Product:

Windows

Summary

Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003, Vista, and Server 2008 allows local users to gain privileges via a crafted application. This vulnerability was actively exploited in the wild in April 2015, known as the Win32k Elevation of Privilege Vulnerability.

Details

Severity	Base Score	CVE
HIGH	7.8	CVE-2015-1701

Exploitation

To exploit this vulnerability, an attacker must have local access to the affected system and execute a specially crafted application. This application can manipulate the Win32k.sys driver to elevate privileges, allowing the attacker to gain unauthorized access to system resources and perform actions with elevated permissions.

Affected Products

• Windows Server 2003 SP2: Affected by the vulnerability allowing local privilege escalation.
• Windows Vista SP2: Vulnerable to exploitation through crafted applications.
• Windows Server 2008 SP2: Local users can exploit this vulnerability to gain elevated privileges.

Mitigation

Apply updates as per vendor instructions to mitigate the risk associated with this vulnerability. Regularly check for security updates and ensure that all systems are patched to the latest versions.

References

• Full Disclosure Mailing List
• Symantec Press Coverage
• SecurityFocus Advisory
• SecurityTracker Advisory
• Microsoft Security Bulletin MS15-051
• Exploit DB Entry 37049
• Exploit DB Entry 37367
• FireEye Threat Research
• CISA Known Exploited Vulnerabilities Catalog