PT-2012-2364 · Microsoft · Windows Vista+6
Publicado
2012-05-08
·
Atualizado
2018-10-12
·
CVE-2012-0165
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft Windows Vista SP2
Microsoft Windows Server 2008 SP2
Microsoft Office 2003 SP3
Microsoft Office 2007 SP2 and SP3
Microsoft Office 2010 Gold and SP1
Description
A remote code execution issue exists in the way GDI+ handles validation of specially crafted EMF images. This could allow remote code execution if a user opens a specially crafted EMF image file. An attacker who successfully exploits this issue could take complete control of an affected system, then install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Recommendations
For Microsoft Windows Vista SP2, apply the relevant security update to resolve the issue.
For Microsoft Windows Server 2008 SP2, apply the relevant security update to resolve the issue.
For Microsoft Office 2003 SP3, apply the relevant security update to resolve the issue.
For Microsoft Office 2007 SP2 and SP3, apply the relevant security update to resolve the issue.
For Microsoft Office 2010 Gold and SP1, apply the relevant security update to resolve the issue.
As a temporary workaround, consider restricting the use of GDI+ for handling EMF images until a patch is available.
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Office
Office 2003
Office 2007
Office 2010
Windows
Windows Server 2008
Windows Vista