Vulnerability Details : CVE-2015-1701
Public exploit exists!
Used for ransomware!
Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka "Win32k Elevation of Privilege Vulnerability."
Vulnerability category: Gain privilege
Products affected by CVE-2015-1701
- cpe:2.3:o:microsoft:windows_2003_server:-:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_2003_server:r2:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
CVE-2015-1701 is in the CISA Known Exploited Vulnerabilities Catalog
This issue is known to have been leveraged as part of a ransomware campaign.
CISA vulnerability name:
Microsoft Win32k Privilege Escalation Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2015-1701
Added on
2022-03-03
Action due date
2022-03-24
Exploit prediction scoring system (EPSS) score for CVE-2015-1701
34.74%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 97 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2015-1701
-
Windows ClientCopyImage Win32k Exploit
Disclosure Date: 2015-05-12First seen: 2020-04-26exploit/windows/local/ms15_051_client_copy_imageThis module exploits improper object handling in the win32k.sys kernel mode driver. This module has been tested on vulnerable builds of Windows 7 x64 and x86, and Windows 2008 R2 SP1 x64. Authors: - Unknown - hfirefox - OJ Reeves - Spencer McIn
CVSS scores for CVE-2015-1701
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST | |
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2025-02-10 |
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST | 2024-07-16 |
References for CVE-2015-1701
-
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-051
Microsoft Security Bulletin MS15-051 - Important | Microsoft DocsPatch;Vendor Advisory
-
https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html
Operation RussianDoll: Adobe & Windows Zero-Day Exploits Likely Leveraged by Russia’s APT28 in Highly-Targeted Attack | FireEye IncThird Party Advisory
-
http://twitter.com/symantec/statuses/590208710527549440
Symantec on Twitter: "TRENDING: RussianDoll #APT28 campaign found using Flash vuln + Windows #0Day. Update #AdobeFlash to stay protected http://t.co/f1yOkkWCFd …"Broken Link
-
http://www.securityfocus.com/bid/74245
Microsoft Windows CVE-2015-1701 Local Privilege Escalation VulnerabilityBroken Link;Third Party Advisory;VDB Entry
-
https://www.exploit-db.com/exploits/37049/
Microsoft Windows - Local Privilege Escalation (MS15-051)Exploit;Third Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1032155
Microsoft Windows Unspecified Flaw Lets Local Users Gain Sysytem Privileges - SecurityTrackerBroken Link;Third Party Advisory;VDB Entry
-
http://seclists.org/fulldisclosure/2020/May/34
Full Disclosure: KL-001-2020-002 : Cellebrite Restricted Desktop Escape and Escalation of User PrivilegeMailing List;Third Party Advisory
-
https://www.exploit-db.com/exploits/37367/
Microsoft Windows - ClientCopyImage Win32k (MS15-051) (Metasploit)Exploit;Third Party Advisory;VDB Entry
Jump to