Microsoft HTTP.sys Remote Code Execution Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-02-10
• EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."

CISA: Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 10 Aug 2022): Apply updates per vendor instructions.

• Patch on docs.microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.htmlExploitThird Party AdvisoryVDB Entry
• www.osvdb.org/120629Broken Link
• www.securityfocus.com/bid/74013Broken LinkThird Party AdvisoryVDB Entry
• www.securitytracker.com/id/1032109Broken LinkThird Party AdvisoryVDB Entry
• docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034PatchVendor Advisory
• www.exploit-db.com/exploits/36773ExploitThird Party AdvisoryVDB Entry
• www.exploit-db.com/exploits/36776ExploitThird Party AdvisoryVDB Entry
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource