Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Informations
Name TA12-227A First vendor Publication 2012-08-14
Vendor US-CERT Last vendor Modification 2012-08-14
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Select Microsoft software products contain multiple vulnerabilities. Microsoft has released updates to address these vulnerabilities.

Description

The Microsoft Security Bulletin Summary for August 2012 describes multiple vulnerabilities in Microsoft software. Microsoft has released updates to address the vulnerabilities.

Impact

A remote, unauthenticated attacker could execute arbitrary code, cause a denial of service, or gain unauthorized access to your files or system.

Solution

Apply updates

Microsoft has provided updates for these vulnerabilities in the Microsoft Security Bulletin Summary for August 2012, which describes any known issues related to the updates. Administrators are encouraged to note these issues and test for any potentially adverse effects. In addition, administrators should consider using an automated update distribution system such as Windows Server Update Services (WSUS). Home users are encouraged to enable automatic updates.

Original Source

Url : http://www.us-cert.gov/cas/techalerts/TA12-227A.html

CWE : Common Weakness Enumeration

% Id Name
38 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
31 % CWE-94 Failure to Control Generation of Code ('Code Injection')
8 % CWE-399 Resource Management Errors
8 % CWE-189 Numeric Errors (CWE/SANS Top 25)
8 % CWE-134 Uncontrolled Format String (CWE/SANS Top 25)
8 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:15079
 
Oval ID: oval:org.mitre.oval:def:15079
Title: Remote Administration Protocol Heap Overflow Vulnerability - MS12-054
Description: Heap-based buffer overflow in the Remote Administration Protocol (RAP) implementation in the LanmanWorkstation service in Microsoft Windows XP SP2 and SP3 allows remote attackers to execute arbitrary code via crafted RAP response packets, aka "Remote Administration Protocol Heap Overflow Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2012-1852
Version: 3
Platform(s): Microsoft Windows XP
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:15240
 
Oval ID: oval:org.mitre.oval:def:15240
Title: Layout memory corruption vulnerability - MS12-052
Description: Microsoft Internet Explorer 6 and 7 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not initialized or (2) is deleted, aka "Layout Memory Corruption Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2012-1526
Version: 7
Platform(s): Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows 7
Product(s): Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:15408
 
Oval ID: oval:org.mitre.oval:def:15408
Title: Remote Administration Protocol Stack Overflow Vulnerability - MS12-054
Description: Stack-based buffer overflow in the Remote Administration Protocol (RAP) implementation in the LanmanWorkstation service in Microsoft Windows XP SP3 allows remote attackers to execute arbitrary code via crafted RAP response packets, aka "Remote Administration Protocol Stack Overflow Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2012-1853
Version: 3
Platform(s): Microsoft Windows XP
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:15447
 
Oval ID: oval:org.mitre.oval:def:15447
Title: MSCOMCTL.OCX RCE Vulnerability - MS12-060
Description: The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Server 2005 SP4, SQL Server 2008 SP2, SP3, R2, R2 SP1, and R2 SP2, Commerce Server 2002 SP4, Commerce Server 2007 SP2, Commerce Server 2009 Gold and R2, Host Integration Server 2004 SP1, Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP2, and Visual Basic 6.0 Runtime allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption, aka "MSCOMCTL.OCX RCE Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2012-1856
Version: 9
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Microsoft Host Integration Server 2004
Microsoft Office 2007
Microsoft Office 2010
Microsoft Office 2003
Microsoft Office 2003 Web Components
Microsoft Visual FoxPro 8.0
Microsoft Visual FoxPro 9.0
Microsoft SQL Server 2000 Analysis Services
Microsoft SQL Server 2000
Microsoft SQL Server 2005
Microsoft SQL Server 2008
Microsoft SQL Server 2008 R2
Microsoft Commerce Server 2002
Microsoft Commerce Server 2007
Microsoft Commerce Server 2009
Microsoft Commerce Server 2009 R2
Microsoft Visual Basic 6.0
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:15498
 
Oval ID: oval:org.mitre.oval:def:15498
Title: Virtual function table corruption remote code execution vulnerability - MS12-052
Description: Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a malformed virtual function table after this table's deletion, aka "Virtual Function Table Corruption Remote Code Execution Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2012-2522
Version: 7
Platform(s): Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows 7
Product(s): Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:15531
 
Oval ID: oval:org.mitre.oval:def:15531
Title: Print Spooler Service Format String Vulnerability - MS12-054
Description: Format string vulnerability in the Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted response, aka "Print Spooler Service Format String Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2012-1851
Version: 5
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Vista
Microsoft Windows XP
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:15650
 
Oval ID: oval:org.mitre.oval:def:15650
Title: Remote Desktop Protocol Vulnerability - MS12-053
Description: The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP3 does not properly process packets in memory, which allows remote attackers to execute arbitrary code by sending crafted RDP packets triggering access to a deleted object, aka "Remote Desktop Protocol Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2012-2526
Version: 3
Platform(s): Microsoft Windows XP
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:15669
 
Oval ID: oval:org.mitre.oval:def:15669
Title: Remote Administration Protocol Denial of Service Vulnerability - MS12-054
Description: The Remote Administration Protocol (RAP) implementation in the LanmanWorkstation service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle RAP responses, which allows remote attackers to cause a denial of service (service hang) via crafted RAP packets, aka "Remote Administration Protocol Denial of Service Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2012-1850
Version: 5
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Vista
Microsoft Windows XP
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:15702
 
Oval ID: oval:org.mitre.oval:def:15702
Title: CGM File Format Memory Corruption Vulnerability - MS12-057
Description: Microsoft Office 2007 SP2 and SP3 and 2010 SP1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Computer Graphics Metafile (CGM) file, aka "CGM File Format Memory Corruption Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2012-2524
Version: 12
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Microsoft Office 2007
Microsoft Office 2010
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:15706
 
Oval ID: oval:org.mitre.oval:def:15706
Title: Win32k Use After Free Vulnerability - MS12-055
Description: Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application, aka "Win32k Use After Free Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2012-2527
Version: 5
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Vista
Microsoft Windows XP
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:15742
 
Oval ID: oval:org.mitre.oval:def:15742
Title: Asynchronous null object access remote code execution vulnerability - MS12-052
Description: Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Asynchronous NULL Object Access Remote Code Execution Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2012-2521
Version: 7
Platform(s): Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows 7
Product(s): Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:15790
 
Oval ID: oval:org.mitre.oval:def:15790
Title: JavaScript Integer Overflow Remote Code Execution Vulnerability - MS12-052 and MS12-056
Description: Integer overflow in Microsoft Internet Explorer 8 and 9, JScript 5.8, and VBScript 5.8 on 64-bit platforms allows remote attackers to execute arbitrary code by leveraging an incorrect size calculation during object copying, aka "JavaScript Integer Overflow Remote Code Execution Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2012-2523
Version: 5
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Microsoft Internet Explorer 8
Microsoft Internet Explorer 9
JScript 5.8
VBScript 5.8
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:15811
 
Oval ID: oval:org.mitre.oval:def:15811
Title: Visio DXF File Format Buffer Overflow Vulnerability - MS12-059
Description: Buffer overflow in Microsoft Visio 2010 SP1 and Visio Viewer 2010 SP1 allows remote attackers to execute arbitrary code via a crafted Visio file, aka "Visio DXF File Format Buffer Overflow Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2012-1888
Version: 7
Platform(s): Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Vista
Microsoft Windows XP
Product(s): Microsoft Visio Viewer 2010
Microsoft Visio 2010
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 4
Application 1
Application 4
Application 1
Application 5
Application 1
Application 21
Application 1
Application 2
Application 2
Application 1
Application 2
Os 4
Os 1
Os 5
Os 1
Os 2

OpenVAS Exploits

Date Description
2012-08-15 Name : Microsoft Internet Explorer Multiple Vulnerabilities (2722913)
File : nvt/secpod_ms12-052.nasl
2012-08-15 Name : Microsoft Remote Desktop Protocol Remote Code Execution Vulnerability (2723135)
File : nvt/secpod_ms12-053.nasl
2012-08-15 Name : Microsoft Windows Networking Components Remote Code Execution Vulnerabilities...
File : nvt/secpod_ms12-054.nasl
2012-08-15 Name : Microsoft Windows Kernel-Mode Drivers Privilege Elevation Vulnerability (2731...
File : nvt/secpod_ms12-055.nasl
2012-08-15 Name : Microsoft JScript and VBScript Engines Remote Code Execution Vulnerability (2...
File : nvt/secpod_ms12-056.nasl
2012-08-15 Name : Microsoft Office Remote Code Execution Vulnerability (2731879)
File : nvt/secpod_ms12-057.nasl
2012-08-15 Name : Microsoft Office Visio/Viewer Remote Code Execution Vulnerability (2733918)
File : nvt/secpod_ms12-059.nasl
2012-08-15 Name : Microsoft Windows Common Controls Remote Code Execution Vulnerability (2720573)
File : nvt/secpod_ms12-060.nasl

Information Assurance Vulnerability Management (IAVM)

Date Description
2012-08-16 IAVM : 2012-B-0075 - Microsoft Office Remote Code Execution Vulnerability
Severity : Category II - VMSKEY : V0033652
2012-08-16 IAVM : 2012-A-0130 - Microsoft JScript and VBScript Engines Remote Code Execution Vulnerability
Severity : Category II - VMSKEY : V0033654
2012-08-16 IAVM : 2012-A-0137 - Multiple Vulnerabilities in Microsoft Windows Networking Components
Severity : Category I - VMSKEY : V0033657
2012-08-16 IAVM : 2012-A-0131 - Microsoft Remote Desktop Remote Code Execution Vulnerability
Severity : Category I - VMSKEY : V0033658
2012-08-16 IAVM : 2012-A-0132 - Microsoft Windows Common Controls Remote Code Execution Vulnerability
Severity : Category II - VMSKEY : V0033659

Snort® IPS/IDS

Date Description
2019-04-18 Microsoft Office MSCOMCTL ActiveX control tabstrip method attempt
RuleID : 49496 - Revision : 1 - Type : FILE-OFFICE
2019-04-18 Microsoft Office MSCOMCTL ActiveX control tabstrip method attempt
RuleID : 49494 - Revision : 1 - Type : FILE-OFFICE
2014-11-16 Microsoft Office .CGM file cell array heap overflow attempt
RuleID : 32064 - Revision : 4 - Type : FILE-OFFICE
2014-11-16 Microsoft Office .CGM file cell array heap overflow attempt
RuleID : 32063 - Revision : 3 - Type : FILE-OFFICE
2014-11-16 Microsoft Office .CGM file cell array heap overflow attempt
RuleID : 32062 - Revision : 4 - Type : FILE-OFFICE
2014-11-16 Microsoft Internet Explorer negative margin use after free attempt
RuleID : 31296 - Revision : 5 - Type : BROWSER-IE
2014-03-06 Microsoft Windows SMB Microsoft Windows RAP API NetServerEnum2 long comment b...
RuleID : 29513 - Revision : 4 - Type : OS-WINDOWS
2014-01-10 Microsoft Internet Explorer virtual function table corruption attempt
RuleID : 27221 - Revision : 3 - Type : BROWSER-IE
2014-01-10 Microsoft Internet Explorer virtual function table corruption attempt
RuleID : 27220 - Revision : 4 - Type : BROWSER-IE
2014-01-10 Microsoft Office MSComctlLib.Toolbar ActiveX control exploit attempt
RuleID : 26832 - Revision : 5 - Type : FILE-OFFICE
2014-01-10 Microsoft Internet Explorer sign extension vulnerability exploitation attempt
RuleID : 25079 - Revision : 5 - Type : BROWSER-IE
2014-01-10 Microsoft Internet Explorer sign extension vulnerability exploitation attempt
RuleID : 25078 - Revision : 8 - Type : BROWSER-IE
2014-01-10 Microsoft Office .CGM file cell array heap overflow attempt
RuleID : 24823 - Revision : 4 - Type : FILE-OFFICE
2014-01-10 Microsoft Windows SMB RAP API NetServerEnum2 long comment buffer overflow att...
RuleID : 24336 - Revision : 12 - Type : OS-WINDOWS
2014-01-10 Microsoft Windows SMB RAP API NetServerEnum2 long server name buffer overflow...
RuleID : 24007 - Revision : 15 - Type : OS-WINDOWS
2014-01-10 Microsoft Office MSCOMCTL ActiveX control tabstrip method attempt
RuleID : 24006 - Revision : 14 - Type : FILE-OFFICE
2014-01-10 Microsoft Office Visio DXF file text overflow attempt
RuleID : 23957 - Revision : 9 - Type : FILE-OFFICE
2014-01-10 Microsoft Office Visio DXF file text overflow attempt
RuleID : 23956 - Revision : 6 - Type : FILE-OFFICE
2014-01-10 MS-RAP NetServerEnum2 read access violation attempt
RuleID : 23847 - Revision : 3 - Type : NETBIOS
2014-01-10 Microsoft Windows Terminal server RDP freed memory write attempt
RuleID : 23846 - Revision : 6 - Type : OS-WINDOWS
2014-01-10 Microsoft Office MSCOMCTL ActiveX control tabstrip method arbitrary code exec...
RuleID : 23845 - Revision : 8 - Type : FILE-MULTIMEDIA
2014-01-10 Microsoft Office MSCOMCTL ActiveX control tabstrip method attempt
RuleID : 23844 - Revision : 14 - Type : FILE-OFFICE
2014-01-10 Microsoft Office Visio DXF file text overflow attempt
RuleID : 23843 - Revision : 10 - Type : FILE-OFFICE
2014-01-10 Microsoft Office Visio DXF file text overflow attempt
RuleID : 23842 - Revision : 13 - Type : FILE-OFFICE
2014-01-10 Microsoft Internet Explorer sign extension vulnerability exploitation attempt
RuleID : 23841 - Revision : 6 - Type : BROWSER-IE
2014-01-10 Microsoft Internet Explorer sign extension vulnerability exploitation attempt
RuleID : 23840 - Revision : 6 - Type : BROWSER-IE
2014-01-10 Microsoft Windows SMB RAP API NetServerEnum2 long server name buffer overflow...
RuleID : 23839 - Revision : 20 - Type : OS-WINDOWS
2014-01-10 Microsoft Windows SMB NetServerEnum response host format string exploit attempt
RuleID : 23838 - Revision : 11 - Type : OS-WINDOWS
2014-01-10 Microsoft Windows SMB host announcement format string exploit attempt
RuleID : 23837 - Revision : 7 - Type : OS-WINDOWS
2014-01-10 Microsoft Internet Explorer negative margin use after free attempt
RuleID : 23836 - Revision : 15 - Type : BROWSER-IE
2014-01-10 Microsoft Internet Explorer asynchronous code execution attempt
RuleID : 23835 - Revision : 10 - Type : BROWSER-IE
2014-01-10 Microsoft Internet Explorer asynchronous code execution attempt
RuleID : 23834 - Revision : 10 - Type : BROWSER-IE
2014-01-10 Microsoft Office .CGM file cell array heap overflow attempt
RuleID : 19156 - Revision : 14 - Type : FILE-OFFICE
2014-01-10 Microsoft Office .CGM file cell array heap overflow attempt
RuleID : 18200 - Revision : 16 - Type : FILE-OFFICE

Nessus® Vulnerability Scanner

Date Description
2012-08-15 Name : The remote host is affected by code execution vulnerabilities.
File : smb_nt_ms12-052.nasl - Type : ACT_GATHER_INFO
2012-08-15 Name : The remote Windows host is affected by a code execution vulnerability.
File : smb_nt_ms12-053.nasl - Type : ACT_GATHER_INFO
2012-08-15 Name : The remote Windows host is potentially affected by multiple code execution vu...
File : smb_nt_ms12-054.nasl - Type : ACT_GATHER_INFO
2012-08-15 Name : The remote Windows host is affected by a privilege escalation vulnerability.
File : smb_nt_ms12-055.nasl - Type : ACT_GATHER_INFO
2012-08-15 Name : Arbitrary code can be executed on the remote host through the installed JScri...
File : smb_nt_ms12-056.nasl - Type : ACT_GATHER_INFO
2012-08-15 Name : Arbitrary code can be executed on the remote host through Microsoft Office.
File : smb_nt_ms12-057.nasl - Type : ACT_GATHER_INFO
2012-08-15 Name : Arbitrary code can be executed on the remote Windows host through Visio or Vi...
File : smb_nt_ms12-059.nasl - Type : ACT_GATHER_INFO
2012-08-15 Name : The remote Windows host has a code execution vulnerability.
File : smb_nt_ms12-060.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2013-01-30 13:27:26
  • Multiple Updates