PT-2012-1216 · Microsoft · Internet Information Services+1

Published 2012-11-13 · Updated 2021-02-05 · CVE-2012-2532

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft FTP Service versions 7.0 through 7.5 for Internet Information Services (IIS)

Description The issue is related to the processing of unspecified commands before TLS is enabled for a session, allowing remote attackers to obtain sensitive information by reading the replies to these commands. It is also described as an error in data exchange via the FTP protocol, which can be exploited by a remote attacker to gain unauthorized access to protected information using specially crafted FTP commands.

Recommendations For Microsoft FTP Service versions 7.0 through 7.5, consider disabling the FTP service until a patch is available to prevent exploitation. Restrict access to the FTP module to minimize the risk of unauthorized access to sensitive information.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2022-02390

CVE-2012-2532

Affected Products

Internet Information Services

Ftp Service

References · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-073 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02390 · Security Note
• https://safe-surf.ru/specialists/base-vulnerabilities/492644 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-2532 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15786 · Note
• http://securityfocus.com/bid/56440 · Note
• https://securitylab.ru/vulnerability/432393.php · Note