JASBUG, formally CVE-2015-0008, was a design flaw in the way Windows Group Policy received and applied data when a domain-joined computer connected to a domain controller. A hacker could potentially lure a business or government computer onto an attacker-controlled network and remotely take control of the device. The vulnerability dated back to 2000 and affected supported versions ranging from Windows Vista and Windows 7 through Windows 8.1 and Windows Server 2012 R2; more than 300 million computers were believed vulnerable when Microsoft disclosed it on February 10, 2015.
Jeff Schmidt, founder of JAS Global Advisors, reported the flaw to Microsoft in January 2014 while his firm and SimMachines were researching Internet infrastructure issues for ICANN. Microsoft spent more than a year engineering a fix because the problem required reworking core operating-system components rather than correcting a simple coding error. It issued patches MS15-011 and MS15-014 on February 10, 2015, while warning that Windows Server 2003, Windows XP, and Windows 2000 could not receive the fix because their architectures lacked the necessary support. DHS’s Industrial Control Systems CERT urged operators to patch urgently, and federal agencies moved to mitigate the risk. The source reports no evidence that attackers exploited JASBUG against corporate or government systems.
