CVE-2012-0151

Опубликовано: 10 апр. 2012

Источник: nvd

CVSS3: 7.8

CVSS2: 9.3

EPSS Высокий

Описание

The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute arbitrary code via a modified file with additional content, aka "WinVerifyTrust Signature Validation Vulnerability."

Ссылки

http://osvdb.org/81135
Broken Link
http://secunia.com/advisories/48581
Broken Link
http://www.securitytracker.com/id?1026906
Broken Link
Third Party Advisory
VDB Entry
http://www.us-cert.gov/cas/techalerts/TA12-101A.html
Third Party Advisory
US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-024
Patch
Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15594
Broken Link
http://osvdb.org/81135
Broken Link
http://secunia.com/advisories/48581
Broken Link
http://www.securitytracker.com/id?1026906
Broken Link
Third Party Advisory
VDB Entry
http://www.us-cert.gov/cas/techalerts/TA12-101A.html
Third Party Advisory
US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-024
Patch
Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15594
Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0151

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:microsoft:windows_7:*:sp1:x64:*:*:*:*:*

cpe:2.3:o:microsoft:windows_7:*:sp1:x86:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:*:sp2:itanium:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x86:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:r2:*:itanium:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:r2:*:x64:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*

cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.8664

Высокий

7.8 High

CVSS3

9.3 Critical

CVSS2

Дефекты

CWE-20

Связанные уязвимости

GHSA-99qx-cj76-9w2h

CVSS3: 7.8

github

почти 4 года назад

BDU:2022-03559

CVSS3: 9.8

fstec