Attacker Value
Low
(1 user assessed)
Exploitability
Very Low
(1 user assessed)
User Interaction
Unknown
Privileges Required
Unknown
Attack Vector
Unknown
0

CVE-2015-1635

Disclosure Date: April 14, 2015
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka “HTTP.sys Remote Code Execution Vulnerability.”

Add Assessment

2
Ratings
  • Attacker Value
    Low
  • Exploitability
    Very Low
Technical Analysis

This vulnerability can still be seen in some companies during internal assessments, however no working exploitation code exists. Only scanners/checkers. SecuritySift managed to achieve information disclosure, however information retrieved is generally not useful.
http://www.securitysift.com/an-analysis-of-ms15-034/

General Information

Technical Analysis