Executive Summary

Summary
Title Vulnerabilities in Microsoft Internet Information Services (IIS) Could Allow Information Disclosure (2733829)
Informations
Name MS12-073 First vendor Publication 2012-11-13
Vendor Microsoft Last vendor Modification 2012-11-20
Severity (Vendor) Moderate Revision 2.1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Severity Rating: Moderate

Revision Note: V2.1 (November 20, 2012): Added missing Server Core installation entries to the Severity table. This is a bulletin change only. There were no changes to the Affected Software table.

Summary: This security update resolves two privately reported vulnerabilities in Microsoft Internet Information Services (IIS). The more severe vulnerability could allow information disclosure if an attacker sends specially crafted FTP commands to the server.

Original Source

Url : http://technet.microsoft.com/en-us/security/bulletin/ms12-073

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-200 Information Exposure

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:15786
 
Oval ID: oval:org.mitre.oval:def:15786
Title: FTP Command Injection Vulnerability - MS12-073
Description: Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) processes unspecified commands before TLS is enabled for a session, which allows remote attackers to obtain sensitive information by reading the replies to these commands, aka "FTP Command Injection Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2012-2532
Version: 5
Platform(s): Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Product(s): Microsoft Internet Information Services 7.0
Microsoft Internet Information Services 7.5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:15959
 
Oval ID: oval:org.mitre.oval:def:15959
Title: Password Disclosure Vulnerability - MS12-073
Description: Microsoft Internet Information Services (IIS) 7.5 uses weak permissions for the Operational log, which allows local users to discover credentials by reading this file, aka "Password Disclosure Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2012-2531
Version: 5
Platform(s): Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Product(s): Microsoft Internet Information Services 7.5
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 2

OpenVAS Exploits

Date Description
2012-11-14 Name : Microsoft Windows IIS FTP Service Information Disclosure Vulnerability (2761226)
File : nvt/secpod_ms12-073.nasl

Information Assurance Vulnerability Management (IAVM)

Date Description
2012-11-15 IAVM : 2012-B-0111 - Multiple Vulnerabilities in Microsoft Internet Information Services (IIS)
Severity : Category I - VMSKEY : V0034953

Nessus® Vulnerability Scanner

Date Description
2012-11-16 Name : The Microsoft IIS service running on the remote system contains flaws that co...
File : iis_ftp7_ms12-073.nasl - Type : ACT_ATTACK
2012-11-14 Name : The Microsoft IIS service running on the remote system contains flaws that co...
File : smb_nt_ms12-073.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
Date Informations
2014-02-17 11:47:28
  • Multiple Updates
2013-11-11 12:41:31
  • Multiple Updates
2012-11-21 00:20:30
  • Multiple Updates
2012-11-21 00:17:02
  • Multiple Updates
2012-11-15 05:20:06
  • Multiple Updates
2012-11-15 05:16:30
  • Multiple Updates
2012-11-14 21:20:52
  • Multiple Updates
2012-11-14 17:22:17
  • Multiple Updates
2012-11-14 13:21:27
  • Multiple Updates
2012-11-13 21:22:40
  • Multiple Updates
2012-11-13 21:18:25
  • First insertion