PT-2012-2357 · Microsoft · Windows Vista+6

Nikolaos Bougalis · Published 2012-03-13 · Updated 2024-10-17 · CVE-2012-0157

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions win32k.sys in Microsoft Windows versions prior to the fixed version

Description The issue arises from the improper handling of window messaging by the win32k.sys kernel-mode driver, allowing local users to gain privileges via a crafted application that calls the PostMessage function. This could enable an attacker to run arbitrary code in kernel mode, potentially leading to the installation of programs, viewing, changing, or deleting data, or creating new accounts with full administrative rights.

Recommendations For Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1, update to a version that includes the fix for the PostMessage function vulnerability. As a temporary workaround, consider restricting the use of the PostMessage function until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2012-0157

Affected Products

Windows

Windows 7

Windows Server 2003

Windows Server 2008

Windows Vista

Windows Xp

Win32K.Sys

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2012-0157 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0157 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-018 · Vendor Advisory
• https://t.me/cvenotify/98659 · Telegram Post
• http://us-cert.gov/cas/techalerts/TA12-073A.html · Note
• http://technet.microsoft.com/en-us/security/bulletin/MS12-018 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14217 · Note
• http://osvdb.org/80002 · Note