CVE-2015-0008
HighSummary
The UNC implementation in Microsoft Windows lacks server-to-client authentication, allowing remote attackers to execute arbitrary code by making crafted data available on a UNC share.
Risk Assessment
An attacker can exploit this vulnerability to remotely execute code, potentially leading to system takeover and data leakage.
Recommendation
It is recommended to update systems to the latest versions and implement appropriate security measures to restrict access to UNC shares.
Other vulnerabilities in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1
See all- CVE-2015-1645High
The vulnerability in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted Enhanced Metafile (EMF) image.
- CVE-2015-0096High
A vulnerability in Microsoft Windows systems allows local users to gain privileges via a malicious DLL in the current working directory. The issue occurs when accessing the icon of crafted shortcuts in Windows Explorer.
Original NVD description (English source)
The UNC implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not include authentication from the server to the client, which allows remote attackers to execute arbitrary code by making crafted data available on a UNC share, as demonstrated by Group Policy data from a spoofed domain controller, aka "Group Policy Remote Code Execution Vulnerability."