Immunity Canvas: MS15_102

2015-09-0900:59:00

Immunity Canvas

exploitlist.immunityinc.com

533

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.164 Low

EPSS

Percentile

95.5%

Name	ms15_102
CVE	CVE-2015-2525 Exploit Pack
Notes:
This module exploits a vulnerability on the Task Scheduler Service (schedsvc.dll).
When a scheduled task is created with the DeleteExpiredTaskAfter (https://msdn.microsoft.com/en-us/library/windows/desktop/aa381847(v=vs.85).aspx) property set, the Task Scheduler will wait that amount of time before deleting the task and its related file. The problem arises because the service deletes the file (through a DeleteFile call) on a callback thread running as local system.
Therefore a junction attack can be mounted against the deletion process. Giving the attacker the primitive to delete any file on the system which local system can delete.