CVE-2015-2430

Vulnerabilidad en Microsoft Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold y R2 y Windows RT Gold y 8.1, permite a atacantes evadir el mecanismo de protección de una aplicación sandbox y realizar acciones del sistema de archivos no especificadas a través de una aplicación manipulada, también conocida como 'Windows Filesystem Elevation of Privilege Vulnerability.'

This vulnerability allows attackers to escalate privileges on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of junction points in the Favorites folder linked to other folders. An attacker running code in the context of a low-rights Internet Explorer process can set up a junction point in the Favorites folder and then the IE broker process will change access control rights in the targeted folders (which are normally unmodifiable by the low-rights process). An attacker can leverage this vulnerability to execute code under the context of a medium integrity process.