CVE-2012-2526

The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP3 does not properly process packets in memory, which allows remote attackers to execute arbitrary code by sending crafted RDP packets triggering access to a deleted object, aka "Remote Desktop Protocol Vulnerability."

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.us-cert.gov/cas/techalerts/TA12-227A.html	Third Party Advisory US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15650

Configurations

Configuration 1 (hide)

cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*

History

No history.

Information

Published : 2012-08-15 01:55

Updated : 2024-02-04 18:16

NVD link : CVE-2012-2526

Mitre link : CVE-2012-2526

CVE.ORG link : CVE-2012-2526

JSON object : View

Products Affected

microsoft

windows_xp

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2012-2526", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-08-15T01:55:01.727", "references": [{"url": "http://www.us-cert.gov/cas/techalerts/TA12-227A.html", "tags": ["Third Party Advisory", "US Government Resource"], "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-053", "source": "secure@microsoft.com"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15650", "source": "secure@microsoft.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP3 does not properly process packets in memory, which allows remote attackers to execute arbitrary code by sending crafted RDP packets triggering access to a deleted object, aka \"Remote Desktop Protocol Vulnerability.\""}, {"lang": "es", "value": "El Protocolo de escritorio remoto (RDP) implementado en Microsoft Windows XP Service Pack 3 no procesa correctamente los paquetes en memoria, permitiendo a atacantes remotos ejecutar c\u00f3digo arbitrario mediante el env\u00edo de paquetes manipulados RDP generando el acceso a un objeto eliminado, tambi\u00e9n conocido como \"Vulnerabilidad en el protocolo de escritorio remoto\"."}], "lastModified": "2018-10-12T22:03:05.483", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE477A73-4EE4-41E9-8694-5A3D5DC88656"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}