Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-1635

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."

Published

2015-04-14T20:59:01.263

Last Modified

2025-10-22T01:16:08.353

Status

Deferred

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

10.0

Impact Score

10.0

Weaknesses

Type: Primary
CWE-94
Type: Secondary
CWE-94

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	microsoft	windows_7	-	Yes
Operating System	microsoft	windows_8	-	Yes
Operating System	microsoft	windows_8.1	-	Yes
Operating System	microsoft	windows_server_2008	r2	Yes
Operating System	microsoft	windows_server_2008	r2	Yes
Operating System	microsoft	windows_server_2012	-	Yes
Operating System	microsoft	windows_server_2012	r2	Yes

References

http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html Exploit, Third Party Advisory, VDB Entry ([email protected])
http://www.osvdb.org/120629 Broken Link ([email protected])
http://www.securityfocus.com/bid/74013 Third Party Advisory, VDB Entry ([email protected])
http://www.securitytracker.com/id/1032109 Third Party Advisory, VDB Entry ([email protected])
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034 Patch, Vendor Advisory ([email protected])
https://www.exploit-db.com/exploits/36773/ Exploit, Third Party Advisory, VDB Entry ([email protected])
https://www.exploit-db.com/exploits/36776/ Exploit, Third Party Advisory, VDB Entry ([email protected])
http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.osvdb.org/120629 Broken Link (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/74013 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id/1032109 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.exploit-db.com/exploits/36773/ Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://www.exploit-db.com/exploits/36776/ Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1635 (134c704f-9b21-4f2e-91b3-4a467353bcc0)