CVE-2015-1635

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-1635
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."

10.0 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html Exploit Third Party Advisory VDB Entry
http://www.osvdb.org/120629 Broken Link
http://www.osvdb.org/120629 Broken Link
http://www.securityfocus.com/bid/74013 Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/74013 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1032109 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1032109 Third Party Advisory VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034 Patch Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034 Patch Vendor Advisory
https://www.exploit-db.com/exploits/36773/ Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/36773/ Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/36776/ Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/36776/ Exploit Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
History

22 Jan 2025, 17:08

Type Values Removed Values Added
References (BID) http://www.securityfocus.com/bid/74013 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/74013 - Third Party Advisory, VDB Entry
References (OSVDB) http://www.osvdb.org/120629 - Broken Link () http://www.osvdb.org/120629 - Broken Link
References (SECTRACK) http://www.securitytracker.com/id/1032109 - Third Party Advisory, VDB Entry () http://www.securitytracker.com/id/1032109 - Third Party Advisory, VDB Entry
References (MISC) http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html - Exploit, Third Party Advisory, VDB Entry
References (EXPLOIT-DB) https://www.exploit-db.com/exploits/36773/ - Exploit, Third Party Advisory, VDB Entry () https://www.exploit-db.com/exploits/36773/ - Exploit, Third Party Advisory, VDB Entry
References (MS) https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034 - Patch, Vendor Advisory () https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034 - Patch, Vendor Advisory
References (EXPLOIT-DB) https://www.exploit-db.com/exploits/36776/ - Exploit, Third Party Advisory, VDB Entry () https://www.exploit-db.com/exploits/36776/ - Exploit, Third Party Advisory, VDB Entry
Information

Published : 2015-04-14 20:59

Updated : 2025-04-07 20:27

NVD link : CVE-2015-1635

Mitre link : CVE-2015-1635

JSON object : View

Products Affected

microsoft

  • windows_7
  • windows_8.1
  • windows_8
  • windows_server_2012
  • windows_server_2008
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')