PT-2012-5585 · Microsoft · Windows

Lucas Apa · Published 2012-12-11 · Updated 2023-12-07 · CVE-2012-4774

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description A remote code execution issue exists due to the way Microsoft Windows parses filenames, potentially allowing attackers to execute arbitrary code in the context of the current user by triggering the use of unallocated memory as the destination of a copy operation.

Recommendations For Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2012-4774

Affected Products

Windows

References · 6

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4774 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-4774 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-081 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15901 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms12-081 · Note
• http://us-cert.gov/cas/techalerts/TA12-346A.html · Note