Vulnerability Details : CVE-2015-1701
Public exploit exists!
Used for ransomware!
Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka "Win32k Elevation of Privilege Vulnerability."
Vulnerability category: Gain privilege
CVE-2015-1701 is in the CISA Known Exploited Vulnerabilities Catalog
This issue is known to have been leveraged as part of a ransomware campaign.
CISA vulnerability name:
Microsoft Win32k Privilege Escalation Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges.
Added on
2022-03-03
Action due date
2022-03-24
Exploit prediction scoring system (EPSS) score for CVE-2015-1701
Probability of exploitation activity in the next 30 days: 0.53%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 77 % EPSS Score History EPSS FAQ
Metasploit modules for CVE-2015-1701
-
Windows ClientCopyImage Win32k Exploit
Disclosure Date: 2015-05-12First seen: 2020-04-26exploit/windows/local/ms15_051_client_copy_imageThis module exploits improper object handling in the win32k.sys kernel mode driver. This module has been tested on vulnerable builds of Windows 7 x64 and x86, and Windows 2008 R2 SP1 x64. Authors: - Unknown - hfirefox - OJ Reeves - Spencer McIn
CVSS scores for CVE-2015-1701
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST |
CWE ids for CVE-2015-1701
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-1701
-
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-051
Microsoft Security Bulletin MS15-051 - Important | Microsoft Docs
-
https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html
Operation RussianDoll: Adobe & Windows Zero-Day Exploits Likely Leveraged by Russia’s APT28 in Highly-Targeted Attack | FireEye Inc
-
http://twitter.com/symantec/statuses/590208710527549440
Symantec on Twitter: "TRENDING: RussianDoll #APT28 campaign found using Flash vuln + Windows #0Day. Update #AdobeFlash to stay protected http://t.co/f1yOkkWCFd …"
-
http://www.securityfocus.com/bid/74245
Microsoft Windows CVE-2015-1701 Local Privilege Escalation Vulnerability
-
https://www.exploit-db.com/exploits/37049/
Microsoft Windows - Local Privilege Escalation (MS15-051)
-
http://www.securitytracker.com/id/1032155
Microsoft Windows Unspecified Flaw Lets Local Users Gain Sysytem Privileges - SecurityTracker
-
http://seclists.org/fulldisclosure/2020/May/34
Full Disclosure: KL-001-2020-002 : Cellebrite Restricted Desktop Escape and Escalation of User Privilege
-
https://www.exploit-db.com/exploits/37367/
Microsoft Windows - ClientCopyImage Win32k (MS15-051) (Metasploit)
Products affected by CVE-2015-1701
- cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:x86:*
- cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:x64:*