PT-2012-1181 · Microsoft · Windows Embedded Standard 2009+6

Luigi Auriemma · Published 2012-03-13 · Updated 2026-03-10 · CVE-2012-0002

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Embedded Standard 2009 Microsoft Windows XP SP2 and SP3 Microsoft Windows Server 2003 SP2 Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2, R2, and R2 SP1 Microsoft Windows 7 Gold and SP1

Description A remote code execution issue exists in the way the Remote Desktop Protocol accesses an object in memory that has been improperly initialized or has been deleted. This allows remote attackers to execute arbitrary code by sending crafted RDP packets, potentially leading to the installation of programs, viewing, changing, or deleting data, or creating new accounts with full user rights. The vulnerability is related to the rdpwd.sys driver in Windows Embedded Standard 2009, which incorrectly handles dynamic memory allocation.

Recommendations For Windows Embedded Standard 2009, consider disabling the rdpwd.sys driver as a temporary workaround until a patch is available. For Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1, update to a newer version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability in some of the affected products, so users should be cautious when using Remote Desktop Protocol.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2015-10403

CVE-2012-0002

ZDI-12-044

Affected Products

Windows

Windows 7

Windows Embedded Standard 2009

Windows Server 2003

Windows Server 2008

Windows Vista

Windows Xp

References · 24

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/rdp/ms12_020_check.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/windows/rdp/ms12_020_maxchannelids.rb · Exploit
• 🔥 https://exploit-db.com/exploits/18606 · Exploit
• https://bdu.fstec.ru/vul/2015-10403 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0002 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-020 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0002 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-12-044 · Security Note
• https://github.com/Dliv3/Venom · Note
• https://github.com/Arvanaghi/SessionGopher · Note
• https://github.com/WinRb/WinRM · Note
• https://github.com/3gstudent/Homework-of-C-Language · Note
• https://github.com/iSecurity-Club/Pentest-Methodologies · Note
• https://github.com/3gstudent/Homework-of-Powershell · Note
• https://github.com/canc3s/OXID · Note