Executive Summary
Informations | |||
---|---|---|---|
Name | TA12-227A | First vendor Publication | 2012-08-14 |
Vendor | US-CERT | Last vendor Modification | 2012-08-14 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 10 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Select Microsoft software products contain multiple vulnerabilities. Microsoft has released updates to address these vulnerabilities. Description The Microsoft Security Bulletin Summary for August 2012 describes multiple vulnerabilities in Microsoft software. Microsoft has released updates to address the vulnerabilities. Impact A remote, unauthenticated attacker could execute arbitrary code, cause a denial of service, or gain unauthorized access to your files or system. Solution Apply updates Microsoft has provided updates for these vulnerabilities in the Microsoft Security Bulletin Summary for August 2012, which describes any known issues related to the updates. Administrators are encouraged to note these issues and test for any potentially adverse effects. In addition, administrators should consider using an automated update distribution system such as Windows Server Update Services (WSUS). Home users are encouraged to enable automatic updates. |
Original Source
Url : http://www.us-cert.gov/cas/techalerts/TA12-227A.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
42 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
25 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
8 % | CWE-399 | Resource Management Errors |
8 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
8 % | CWE-134 | Uncontrolled Format String (CWE/SANS Top 25) |
8 % | CWE-20 | Improper Input Validation |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:15079 | |||
Oval ID: | oval:org.mitre.oval:def:15079 | ||
Title: | Remote Administration Protocol Heap Overflow Vulnerability - MS12-054 | ||
Description: | Heap-based buffer overflow in the Remote Administration Protocol (RAP) implementation in the LanmanWorkstation service in Microsoft Windows XP SP2 and SP3 allows remote attackers to execute arbitrary code via crafted RAP response packets, aka "Remote Administration Protocol Heap Overflow Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-1852 | Version: | 3 |
Platform(s): | Microsoft Windows XP | Product(s): | |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:15240 | |||
Oval ID: | oval:org.mitre.oval:def:15240 | ||
Title: | Layout memory corruption vulnerability - MS12-052 | ||
Description: | Microsoft Internet Explorer 6 and 7 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not initialized or (2) is deleted, aka "Layout Memory Corruption Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-1526 | Version: | 7 |
Platform(s): | Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 | Product(s): | Microsoft Internet Explorer 6 Microsoft Internet Explorer 7 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:15408 | |||
Oval ID: | oval:org.mitre.oval:def:15408 | ||
Title: | Remote Administration Protocol Stack Overflow Vulnerability - MS12-054 | ||
Description: | Stack-based buffer overflow in the Remote Administration Protocol (RAP) implementation in the LanmanWorkstation service in Microsoft Windows XP SP3 allows remote attackers to execute arbitrary code via crafted RAP response packets, aka "Remote Administration Protocol Stack Overflow Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-1853 | Version: | 3 |
Platform(s): | Microsoft Windows XP | Product(s): | |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:15447 | |||
Oval ID: | oval:org.mitre.oval:def:15447 | ||
Title: | MSCOMCTL.OCX RCE Vulnerability - MS12-060 | ||
Description: | The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Server 2005 SP4, SQL Server 2008 SP2, SP3, R2, R2 SP1, and R2 SP2, Commerce Server 2002 SP4, Commerce Server 2007 SP2, Commerce Server 2009 Gold and R2, Host Integration Server 2004 SP1, Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP2, and Visual Basic 6.0 Runtime allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption, aka "MSCOMCTL.OCX RCE Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-1856 | Version: | 9 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Microsoft Host Integration Server 2004 Microsoft Office 2007 Microsoft Office 2010 Microsoft Office 2003 Microsoft Office 2003 Web Components Microsoft Visual FoxPro 8.0 Microsoft Visual FoxPro 9.0 Microsoft SQL Server 2000 Analysis Services Microsoft SQL Server 2000 Microsoft SQL Server 2005 Microsoft SQL Server 2008 Microsoft SQL Server 2008 R2 Microsoft Commerce Server 2002 Microsoft Commerce Server 2007 Microsoft Commerce Server 2009 Microsoft Commerce Server 2009 R2 Microsoft Visual Basic 6.0 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:15498 | |||
Oval ID: | oval:org.mitre.oval:def:15498 | ||
Title: | Virtual function table corruption remote code execution vulnerability - MS12-052 | ||
Description: | Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a malformed virtual function table after this table's deletion, aka "Virtual Function Table Corruption Remote Code Execution Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-2522 | Version: | 7 |
Platform(s): | Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 | Product(s): | Microsoft Internet Explorer 6 Microsoft Internet Explorer 7 Microsoft Internet Explorer 8 Microsoft Internet Explorer 9 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:15531 | |||
Oval ID: | oval:org.mitre.oval:def:15531 | ||
Title: | Print Spooler Service Format String Vulnerability - MS12-054 | ||
Description: | Format string vulnerability in the Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted response, aka "Print Spooler Service Format String Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-1851 | Version: | 5 |
Platform(s): | Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:15650 | |||
Oval ID: | oval:org.mitre.oval:def:15650 | ||
Title: | Remote Desktop Protocol Vulnerability - MS12-053 | ||
Description: | The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP3 does not properly process packets in memory, which allows remote attackers to execute arbitrary code by sending crafted RDP packets triggering access to a deleted object, aka "Remote Desktop Protocol Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-2526 | Version: | 3 |
Platform(s): | Microsoft Windows XP | Product(s): | |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:15669 | |||
Oval ID: | oval:org.mitre.oval:def:15669 | ||
Title: | Remote Administration Protocol Denial of Service Vulnerability - MS12-054 | ||
Description: | The Remote Administration Protocol (RAP) implementation in the LanmanWorkstation service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle RAP responses, which allows remote attackers to cause a denial of service (service hang) via crafted RAP packets, aka "Remote Administration Protocol Denial of Service Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-1850 | Version: | 5 |
Platform(s): | Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:15702 | |||
Oval ID: | oval:org.mitre.oval:def:15702 | ||
Title: | CGM File Format Memory Corruption Vulnerability - MS12-057 | ||
Description: | Microsoft Office 2007 SP2 and SP3 and 2010 SP1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Computer Graphics Metafile (CGM) file, aka "CGM File Format Memory Corruption Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-2524 | Version: | 12 |
Platform(s): | Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Microsoft Office 2007 Microsoft Office 2010 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:15706 | |||
Oval ID: | oval:org.mitre.oval:def:15706 | ||
Title: | Win32k Use After Free Vulnerability - MS12-055 | ||
Description: | Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application, aka "Win32k Use After Free Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-2527 | Version: | 5 |
Platform(s): | Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:15742 | |||
Oval ID: | oval:org.mitre.oval:def:15742 | ||
Title: | Asynchronous null object access remote code execution vulnerability - MS12-052 | ||
Description: | Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Asynchronous NULL Object Access Remote Code Execution Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-2521 | Version: | 7 |
Platform(s): | Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 | Product(s): | Microsoft Internet Explorer 6 Microsoft Internet Explorer 7 Microsoft Internet Explorer 8 Microsoft Internet Explorer 9 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:15790 | |||
Oval ID: | oval:org.mitre.oval:def:15790 | ||
Title: | JavaScript Integer Overflow Remote Code Execution Vulnerability - MS12-052 and MS12-056 | ||
Description: | Integer overflow in Microsoft Internet Explorer 8 and 9, JScript 5.8, and VBScript 5.8 on 64-bit platforms allows remote attackers to execute arbitrary code by leveraging an incorrect size calculation during object copying, aka "JavaScript Integer Overflow Remote Code Execution Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-2523 | Version: | 5 |
Platform(s): | Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Microsoft Internet Explorer 8 Microsoft Internet Explorer 9 JScript 5.8 VBScript 5.8 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:15811 | |||
Oval ID: | oval:org.mitre.oval:def:15811 | ||
Title: | Visio DXF File Format Buffer Overflow Vulnerability - MS12-059 | ||
Description: | Buffer overflow in Microsoft Visio 2010 SP1 and Visio Viewer 2010 SP1 allows remote attackers to execute arbitrary code via a crafted Visio file, aka "Visio DXF File Format Buffer Overflow Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-1888 | Version: | 7 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Microsoft Visio Viewer 2010 Microsoft Visio 2010 |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2012-08-15 | Name : Microsoft Internet Explorer Multiple Vulnerabilities (2722913) File : nvt/secpod_ms12-052.nasl |
2012-08-15 | Name : Microsoft Remote Desktop Protocol Remote Code Execution Vulnerability (2723135) File : nvt/secpod_ms12-053.nasl |
2012-08-15 | Name : Microsoft Windows Networking Components Remote Code Execution Vulnerabilities... File : nvt/secpod_ms12-054.nasl |
2012-08-15 | Name : Microsoft Windows Kernel-Mode Drivers Privilege Elevation Vulnerability (2731... File : nvt/secpod_ms12-055.nasl |
2012-08-15 | Name : Microsoft JScript and VBScript Engines Remote Code Execution Vulnerability (2... File : nvt/secpod_ms12-056.nasl |
2012-08-15 | Name : Microsoft Office Remote Code Execution Vulnerability (2731879) File : nvt/secpod_ms12-057.nasl |
2012-08-15 | Name : Microsoft Office Visio/Viewer Remote Code Execution Vulnerability (2733918) File : nvt/secpod_ms12-059.nasl |
2012-08-15 | Name : Microsoft Windows Common Controls Remote Code Execution Vulnerability (2720573) File : nvt/secpod_ms12-060.nasl |
Information Assurance Vulnerability Management (IAVM)
Date | Description |
---|---|
2012-08-16 | IAVM : 2012-B-0075 - Microsoft Office Remote Code Execution Vulnerability Severity : Category II - VMSKEY : V0033652 |
2012-08-16 | IAVM : 2012-A-0130 - Microsoft JScript and VBScript Engines Remote Code Execution Vulnerability Severity : Category II - VMSKEY : V0033654 |
2012-08-16 | IAVM : 2012-A-0137 - Multiple Vulnerabilities in Microsoft Windows Networking Components Severity : Category I - VMSKEY : V0033657 |
2012-08-16 | IAVM : 2012-A-0131 - Microsoft Remote Desktop Remote Code Execution Vulnerability Severity : Category I - VMSKEY : V0033658 |
2012-08-16 | IAVM : 2012-A-0132 - Microsoft Windows Common Controls Remote Code Execution Vulnerability Severity : Category II - VMSKEY : V0033659 |
Snort® IPS/IDS
Date | Description |
---|---|
2019-04-18 | Microsoft Office MSCOMCTL ActiveX control tabstrip method attempt RuleID : 49496 - Revision : 1 - Type : FILE-OFFICE |
2019-04-18 | Microsoft Office MSCOMCTL ActiveX control tabstrip method attempt RuleID : 49494 - Revision : 1 - Type : FILE-OFFICE |
2014-11-16 | Microsoft Office .CGM file cell array heap overflow attempt RuleID : 32064 - Revision : 4 - Type : FILE-OFFICE |
2014-11-16 | Microsoft Office .CGM file cell array heap overflow attempt RuleID : 32063 - Revision : 3 - Type : FILE-OFFICE |
2014-11-16 | Microsoft Office .CGM file cell array heap overflow attempt RuleID : 32062 - Revision : 4 - Type : FILE-OFFICE |
2014-11-16 | Microsoft Internet Explorer negative margin use after free attempt RuleID : 31296 - Revision : 5 - Type : BROWSER-IE |
2014-03-06 | Microsoft Windows SMB Microsoft Windows RAP API NetServerEnum2 long comment b... RuleID : 29513 - Revision : 4 - Type : OS-WINDOWS |
2014-01-10 | Microsoft Internet Explorer virtual function table corruption attempt RuleID : 27221 - Revision : 3 - Type : BROWSER-IE |
2014-01-10 | Microsoft Internet Explorer virtual function table corruption attempt RuleID : 27220 - Revision : 4 - Type : BROWSER-IE |
2014-01-10 | Microsoft Office MSComctlLib.Toolbar ActiveX control exploit attempt RuleID : 26832 - Revision : 5 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Internet Explorer sign extension vulnerability exploitation attempt RuleID : 25079 - Revision : 5 - Type : BROWSER-IE |
2014-01-10 | Microsoft Internet Explorer sign extension vulnerability exploitation attempt RuleID : 25078 - Revision : 8 - Type : BROWSER-IE |
2014-01-10 | Microsoft Office .CGM file cell array heap overflow attempt RuleID : 24823 - Revision : 4 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Windows SMB RAP API NetServerEnum2 long comment buffer overflow att... RuleID : 24336 - Revision : 12 - Type : OS-WINDOWS |
2014-01-10 | Microsoft Windows SMB RAP API NetServerEnum2 long server name buffer overflow... RuleID : 24007 - Revision : 15 - Type : OS-WINDOWS |
2014-01-10 | Microsoft Office MSCOMCTL ActiveX control tabstrip method attempt RuleID : 24006 - Revision : 14 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office Visio DXF file text overflow attempt RuleID : 23957 - Revision : 9 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office Visio DXF file text overflow attempt RuleID : 23956 - Revision : 6 - Type : FILE-OFFICE |
2014-01-10 | MS-RAP NetServerEnum2 read access violation attempt RuleID : 23847 - Revision : 3 - Type : NETBIOS |
2014-01-10 | Microsoft Windows Terminal server RDP freed memory write attempt RuleID : 23846 - Revision : 6 - Type : OS-WINDOWS |
2014-01-10 | Microsoft Office MSCOMCTL ActiveX control tabstrip method arbitrary code exec... RuleID : 23845 - Revision : 8 - Type : FILE-MULTIMEDIA |
2014-01-10 | Microsoft Office MSCOMCTL ActiveX control tabstrip method attempt RuleID : 23844 - Revision : 14 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office Visio DXF file text overflow attempt RuleID : 23843 - Revision : 10 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office Visio DXF file text overflow attempt RuleID : 23842 - Revision : 13 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Internet Explorer sign extension vulnerability exploitation attempt RuleID : 23841 - Revision : 6 - Type : BROWSER-IE |
2014-01-10 | Microsoft Internet Explorer sign extension vulnerability exploitation attempt RuleID : 23840 - Revision : 6 - Type : BROWSER-IE |
2014-01-10 | Microsoft Windows SMB RAP API NetServerEnum2 long server name buffer overflow... RuleID : 23839 - Revision : 20 - Type : OS-WINDOWS |
2014-01-10 | Microsoft Windows SMB NetServerEnum response host format string exploit attempt RuleID : 23838 - Revision : 11 - Type : OS-WINDOWS |
2014-01-10 | Microsoft Windows SMB host announcement format string exploit attempt RuleID : 23837 - Revision : 7 - Type : OS-WINDOWS |
2014-01-10 | Microsoft Internet Explorer negative margin use after free attempt RuleID : 23836 - Revision : 15 - Type : BROWSER-IE |
2014-01-10 | Microsoft Internet Explorer asynchronous code execution attempt RuleID : 23835 - Revision : 10 - Type : BROWSER-IE |
2014-01-10 | Microsoft Internet Explorer asynchronous code execution attempt RuleID : 23834 - Revision : 10 - Type : BROWSER-IE |
2014-01-10 | Microsoft Office .CGM file cell array heap overflow attempt RuleID : 19156 - Revision : 14 - Type : FILE-OFFICE |
2014-01-10 | Microsoft Office .CGM file cell array heap overflow attempt RuleID : 18200 - Revision : 16 - Type : FILE-OFFICE |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2012-08-15 | Name : The remote host is affected by code execution vulnerabilities. File : smb_nt_ms12-052.nasl - Type : ACT_GATHER_INFO |
2012-08-15 | Name : The remote Windows host is affected by a code execution vulnerability. File : smb_nt_ms12-053.nasl - Type : ACT_GATHER_INFO |
2012-08-15 | Name : The remote Windows host is potentially affected by multiple code execution vu... File : smb_nt_ms12-054.nasl - Type : ACT_GATHER_INFO |
2012-08-15 | Name : The remote Windows host is affected by a privilege escalation vulnerability. File : smb_nt_ms12-055.nasl - Type : ACT_GATHER_INFO |
2012-08-15 | Name : Arbitrary code can be executed on the remote host through the installed JScri... File : smb_nt_ms12-056.nasl - Type : ACT_GATHER_INFO |
2012-08-15 | Name : Arbitrary code can be executed on the remote host through Microsoft Office. File : smb_nt_ms12-057.nasl - Type : ACT_GATHER_INFO |
2012-08-15 | Name : Arbitrary code can be executed on the remote Windows host through Visio or Vi... File : smb_nt_ms12-059.nasl - Type : ACT_GATHER_INFO |
2012-08-15 | Name : The remote Windows host has a code execution vulnerability. File : smb_nt_ms12-060.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2013-01-30 13:27:26 |
|