FYI…
MS Windows 0-day - in-the-wild …
- http://www.securitytracker.com/id/1032155
CVE Reference: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1701 - 7.2 (HIGH)
Apr 20 2015
Impact: Root access via local system
Vendor Confirmed: Yes
Description: A vulnerability was reported in Microsoft Windows. A local user can obtain system privileges on the target system. A local user can run a specially crafted program to execute a callback to use data from the system token and execute code with System privileges.
Microsoft Windows 8 and later are reportedly not affected.
This vulnerability is being actively exploited.
The original advisory is available at:
- https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html
Apr 18, 2015
"FireEye reported this vulnerability…"
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1701 - 7.2 (HIGH)
Last revised: 04/21/2015 - "… as exploited in the wild in April 2015…"
___
- http://www.theinquirer.net/inquirer/news/2404757/russian-hacker-group-apt28-is-exploiting-flaws-in-adobe-flash-and-windows
Apr 20 2015 - "… Microsoft is aware of the outstanding local privilege escalation vulnerability in Windows, named CVE-2015-1701, but has -not- yet issued a patch… updating Adobe Flash to the latest version will render the exploit -harmless- because it has seen CVE-2015-1701 in use -only- in conjunction with the Adobe Flash exploit for CVE-2015-3043. The Flash exploit is served from unobfuscated HTML/JS. The launcher page picks one of two Flash files to deliver depending on the target's platform… The APT28 attackers relied heavily on the CVE-2014-0515 Metasploit module to conduct these new exploits…"
___
MS15-051…
Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (3057191)
- https://technet.microsoft.com/library/security/ms15-051
May 12, 2015
- https://support.microsoft.com/en-us/kb/3057191
Last Review: May 13, 2015 - Rev: 2.0
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1701
Last revised: 05/13/2015
7.2 (HIGH)
