Vulnerabilities > CVE-2012-1851 - Use of Externally-Controlled Format String vulnerability in Microsoft products
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
Format string vulnerability in the Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted response, aka "Print Spooler Service Format String Vulnerability."
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| OS | 13 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Format String Injection An attacker includes formatting characters in a string input field on the target application. Most applications assume that users will provide static text and may respond unpredictably to the presence of formatting character. For example, in certain functions of the C programming languages such as printf, the formatting character %s will print the contents of a memory location expecting this location to identify a string and the formatting character %n prints the number of DWORD written in the memory. An attacker can use this to read or write to memory locations or files, or simply to manipulate the value of the resulting text in unexpected ways. Reading or writing memory may result in program crashes and writing memory could result in the execution of arbitrary code if the attacker can write to the program stack.
- String Format Overflow in syslog() This attack targets the format string vulnerabilities in the syslog() function. An attacker would typically inject malicious input in the format string parameter of the syslog function. This is a common problem, and many public vulnerabilities and associated exploits have been posted.
Msbulletin
| bulletin_id | MS12-054 |
| bulletin_url | |
| date | 2012-08-14T00:00:00 |
| impact | Remote Code Execution |
| knowledgebase_id | 2733594 |
| knowledgebase_url | |
| severity | Critical |
| title | Vulnerabilities in Windows Networking Components Could Allow Remote Code Execution |
Nessus
| NASL family | Windows : Microsoft Bulletins |
| NASL id | SMB_NT_MS12-054.NASL |
| description | The remote Windows host is potentially affected by the following vulnerabilities : - A denial of service vulnerability exists in Windows networking components. The vulnerability is due to the service not properly handling specially crafted RAP requests. (CVE-2012-1850) - A remote code execution vulnerability exists in the Windows Print Spooler service that can allow a remote, unauthenticated attacker to execute arbitrary code on an affected system. (CVE-2012-1851) - A remote code execution vulnerability exists in the way that Windows networking components handle specially crafted RAP responses. (CVE-2012-1852, CVE-2012-1853) |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 61529 |
| published | 2012-08-15 |
| reporter | This script is Copyright (C) 2012-2018 Tenable Network Security, Inc. |
| source | https://www.tenable.com/plugins/nessus/61529 |
| title | MS12-054: Vulnerabilities in Windows Networking Components Could Allow Remote Code Execution (2733594) |
| code | |
Oval
| accepted | 2014-03-03T04:00:51.389-05:00 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| contributors |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| description | Format string vulnerability in the Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted response, aka "Print Spooler Service Format String Vulnerability." | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| family | windows | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| id | oval:org.mitre.oval:def:15531 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| status | accepted | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| submitted | 2012-08-20T15:13:07 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| title | Print Spooler Service Format String Vulnerability - MS12-054 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| version | 76 |
Seebug
| bulletinFamily | exploit |
| description | Bugtraq ID:54928 CVE ID:CVE-2012-1851 Microsoft Windows是一款流行的操作系统。 Microsoft Windows的Print Spooler服务存在格式串漏洞，允许攻击者通过构建特制的应答触发典型的格式串漏洞，可以服务进程上下文执行任意代码。 0 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows vista Microsoft Windows Server 2008 Microsoft Windows 7 厂商解决方案 用户可参考如下供应商提供的安全公告获得补丁信息： http://technet.microsoft.com/en-us/security/bulletin/ms12-054 |
| id | SSV:60332 |
| last seen | 2017-11-19 |
| modified | 2012-08-18 |
| published | 2012-08-18 |
| reporter | Root |
| title | Microsoft Windows Print Spooler 远程代码执行漏洞(CVE-2012-1851) |
References
- http://www.us-cert.gov/cas/techalerts/TA12-227A.html
- http://www.us-cert.gov/cas/techalerts/TA12-227A.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-054
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-054
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15531
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15531