SMB: Microsoft Windows CVE-2015-0096 Remote Code Exectution

This signature detects attempts to exploit a known vulnerability in the Microsoft Windows. A successful attack can lead to arbitrary code execution.

Extended Description

Untrusted search path vulnerability in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, leading to DLL loading during Windows Explorer access to the icon of a crafted shortcut, aka "DLL Planting Remote Code Execution Vulnerability."

Affected Products

Microsoft windows_server_2003

References

CVE: CVE-2015-0096

URL: http://securitytracker.com/id?1024216 https://technet.microsoft.com/library/security/ms15-020 http://h30499.www3.hp.com/t5/hp-security-research-blog/full-details-on-cve-2015-0096-and-the-failed-ms10-046-stuxnet/ba-p/6718459#.vqg0apnf_tp https://technet.microsoft.com/en-us/library/security/ms15-020 http://www.zerodayinitiative.com/advisories/zdi-15-086/

Short Name

SMB:EXPLOIT:MS-2015-0096-CE

Severity

Major

Recommended

True

Recommended Action

Drop

SMB: Microsoft Windows CVE-2015-0096 Remote Code Exectution

Extended Description

Affected Products

References

Found a potential security threat?