CVE-2015-6095
First published: Wed Nov 11 2015(Updated: )
Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandles password changes, which allows physically proximate attackers to bypass authentication, and conduct decryption attacks against certain BitLocker configurations, by connecting to an unintended Key Distribution Center (KDC), aka "Windows Kerberos Security Feature Bypass."
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Windows 10 | ||
| Microsoft Windows 10 | =1511 | |
| Microsoft Windows 7 | =sp1 | |
| Microsoft Windows 8.0 | ||
| Microsoft Windows 8.1 | ||
| Microsoft Windows Server | =sp2 | |
| Microsoft Windows Server | =r2-sp1 | |
| Microsoft Windows Server | =r2-sp1 | |
| Microsoft Windows Server | ||
| Microsoft Windows Server | =r2 | |
| Microsoft Windows Vista | =sp2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2015-6095?
CVE-2015-6095 has a critical severity rating as it allows attackers to bypass authentication on affected systems.
How do I fix CVE-2015-6095?
To fix CVE-2015-6095, apply the latest security updates provided by Microsoft for the affected Windows operating systems.
Which versions of Windows are affected by CVE-2015-6095?
CVE-2015-6095 affects Windows Vista SP2, Windows 7 SP1, Windows 8, Windows 8.1, Windows 10, and several versions of Windows Server.
Can CVE-2015-6095 be exploited remotely?
CVE-2015-6095 requires physical proximity for exploitation, meaning an attacker must have local access to the affected machine.
What type of vulnerability is CVE-2015-6095 classified as?
CVE-2015-6095 is classified as an authentication bypass vulnerability within the Kerberos authentication protocol.
- agent/references
- agent/type
- agent/remedy
- agent/weakness
- agent/author
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/microsoft
- canonical/microsoft windows 10
- version/microsoft windows 10/1511
- canonical/microsoft windows 7
- version/microsoft windows 7/sp1
- canonical/microsoft windows 8.0
- canonical/microsoft windows 8.1
- canonical/microsoft windows server
- version/microsoft windows server/sp2
- version/microsoft windows server/r2-sp1
- version/microsoft windows server/r2
- canonical/microsoft windows vista
- version/microsoft windows vista/sp2