Microsoft · Windows Rt · CVE-2013-3200
**Name of the Vulnerable Software and Affected Versions**
Microsoft Windows XP versions SP2 through SP3
Microsoft Windows Server 2003 version SP2
Microsoft Windows Vista version SP2
Microsoft Windows Server 2008 versions SP2 through R2 SP1
Microsoft Windows 7 version SP1
Microsoft Windows 8
Microsoft Windows Server 2012
Microsoft Windows RT
**Description**
The issue allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device. An elevation of privilege vulnerability exists when Windows USB drivers improperly handle objects in memory, potentially allowing an attacker to run arbitrary code in kernel mode. This could enable the attacker to install programs, view, change, or delete data, or create new accounts with full administrative rights.
**Recommendations**
For Microsoft Windows XP versions SP2 through SP3, update to a newer version to mitigate the risk.
For Microsoft Windows Server 2003 version SP2, update to a newer version to mitigate the risk.
For Microsoft Windows Vista version SP2, update to a newer version to mitigate the risk.
For Microsoft Windows Server 2008 versions SP2 through R2 SP1, update to a newer version to mitigate the risk.
For Microsoft Windows 7 version SP1, update to a newer version to mitigate the risk.
For Microsoft Windows 8, update to a newer version to mitigate the risk.
For Microsoft Windows Server 2012, update to a newer version to mitigate the risk.
For Microsoft Windows RT, update to a newer version to mitigate the risk.
As a temporary workaround, consider disabling the use of USB devices until a patch is available. Restrict access to the USB drivers to minimize the risk of exploitation.