PT-2012-1231 · Microsoft · Windows Vista+6

Igor Glucksmann + 1 · Published 2012-04-10 · Updated 2025-04-04 · CVE-2012-0151

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview

Description The Authenticode Signature Verification function in Microsoft Windows does not properly validate the digest of a signed portable executable (PE) file. This allows user-assisted remote attackers to execute arbitrary code via a modified file with additional content. An attacker could exploit the vulnerability by modifying an existing signed executable file to add malicious code without invalidating the signature, potentially taking complete control of an affected system.

Recommendations For Microsoft Windows XP SP2 and SP3, consider applying security updates or patches to fix the Authenticode Signature Verification issue. For Windows Server 2003 SP2, apply the recommended security patch to resolve the vulnerability. For Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview, update to a newer version or apply the relevant security fix to mitigate the risk of exploitation. As a temporary workaround, consider restricting the execution of signed portable executable (PE) files until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-03559

CVE-2012-0151

Affected Products

Windows

Windows 7

Windows 8

Windows Server 2003

Windows Server 2008

Windows Vista

Windows Xp

References · 18

• https://bdu.fstec.ru/vul/2022-03559 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-0151 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-024 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0151 · Security Note
• http://technet.microsoft.com/en-us/security/bulletin/ms12-024 · Note
• http://secunia.com/advisories/48581 · Note
• https://t.me/aptreports/787 · Telegram Post
• https://t.me/cvenotify/109961 · Telegram Post
• http://securitytracker.com/id?1026906 · Note
• https://t.me/cvenotify/104961 · Telegram Post
• https://t.me/cvenotify/117899 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://research.checkpoint.com/2022/can-you-trust-a-files-digital-signature-new-zloader-campaign-exploits-microsofts-signature-verification-putting-users-at-risk · Note
• https://t.me/aptreports/779 · Telegram Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note