Attacker Value
Low
(1 user assessed)
Exploitability
Very Low
(1 user assessed)
User Interaction
Unknown
Privileges Required
Unknown
Attack Vector
Unknown
0

CVE-2015-1635

Disclosure Date: April 14, 2015
Exploited in the Wild
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka “HTTP.sys Remote Code Execution Vulnerability.”

Add Assessment

2
Ratings
  • Attacker Value
    Low
  • Exploitability
    Very Low
Technical Analysis

This vulnerability can still be seen in some companies during internal assessments, however no working exploitation code exists. Only scanners/checkers. SecuritySift managed to achieve information disclosure, however information retrieved is generally not useful.
http://www.securitysift.com/an-analysis-of-ms15-034/

CVSS V3 Severity and Metrics
Base Score:
None
Impact Score:
Unknown
Exploitability Score:
Unknown
Vector:
Unknown
Attack Vector (AV):
Unknown
Attack Complexity (AC):
Unknown
Privileges Required (PR):
Unknown
User Interaction (UI):
Unknown
Scope (S):
Unknown
Confidentiality (C):
Unknown
Integrity (I):
Unknown
Availability (A):
Unknown

General Information

Vendors

  • microsoft

Products

  • windows 7 -,
  • windows 8 -,
  • windows 8.1 -,
  • windows server 2008 r2,
  • windows server 2012 -,
  • windows server 2012 r2

Exploited in the Wild

Reported by:
Technical Analysis