CVE-2015-1635 in microsoft windows 7
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
Affected software: microsoft windows 7, microsoft windows 8, microsoft windows 8.1, microsoft windows server 2008, microsoft windows server 2012
Scores
- CVSS: 9.8 (critical)
- EPSS: 100.00% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2022-02-10
- Published: 2015-04-14
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Install MS15-034 for HTTP.sys (CVE-2015-1635)
Patch or upgrade. MS15-034 fixes the HTTP.sys Range header flaw that crashes or takes over IIS hosts.
Applies to: Windows 7, 8, 8.1, Server 2008 R2, 2012 and 2012 R2 without MS15-034
- Check that MS15-034 or a later update is installed on Windows hosts running IIS.
- Until patched, disable IIS kernel caching.
- Retire Windows versions that can no longer be updated.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.