Vulnerabilities > CVE-2012-1889 - Out-of-bounds Write vulnerability in Microsoft XML Core Services

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
microsoft
CWE-787
nessus
exploit available
metasploit

Summary

Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

Common Weakness Enumeration (CWE)

Exploit-Db

descriptionMicrosoft XML Core Services MSXML Uninitialized Memory Corruption. CVE-2012-1889. Remote exploit for windows platform
idEDB-ID:19186
last seen2016-02-02
modified2012-06-16
published2012-06-16
reportermetasploit
sourcehttps://www.exploit-db.com/download/19186/
titleMicrosoft XML Core Services MSXML Uninitialized Memory Corruption

Metasploit

descriptionThis module exploits a memory corruption flaw in Microsoft XML Core Services when trying to access an uninitialized Node with the getDefinition API, which may corrupt memory allowing remote code execution.
idMSF:EXPLOIT/WINDOWS/BROWSER/MSXML_GET_DEFINITION_CODE_EXEC
last seen2020-05-15
modified2020-02-18
published2012-06-16
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/browser/msxml_get_definition_code_exec.rb
titleMS12-043 Microsoft XML Core Services MSXML Uninitialized Memory Corruption

Msbulletin

bulletin_idMS12-043
bulletin_url
date2012-10-09T00:00:00
impactRemote Code Execution
knowledgebase_id2722479
knowledgebase_url
severityCritical
titleVulnerability in Microsoft XML Core Services Could Allow Remote Code Execution

Nessus

  • NASL familyWindows
    NASL idSMB_KB2719615.NASL
    descriptionThe remote host is missing the workaround referenced in KB 2719615. An issue exists in Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 when the application attempts to access an object in memory that has not been initialized, which may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged-on user.
    last seen2017-10-29
    modified2017-08-30
    plugin id59461
    published2012-06-13
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=59461
    titleMS KB2719615: Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution
    code
    #%NASL_MIN_LEVEL 999999
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # @DEPRECATED@
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(59461);
      script_version("1.11");
      script_cvs_date("Date: 2018/07/27 18:38:15");
    
      script_cve_id("CVE-2012-1889");
      script_bugtraq_id(53934);
      script_xref(name:"EDB-ID", value:"19186");
      script_xref(name:"MSKB", value:"2719615");
    
      script_name(english:"MS KB2719615: Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution");
      script_summary(english:"Checks for workaround");
    
      script_set_attribute(attribute:"synopsis", value:
    "Arbitrary code can be executed on the remote host through a web 
    browser.");
      script_set_attribute(attribute:"description", value:
    "The remote host is missing the workaround referenced in KB 2719615.
    
    An issue exists in Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 
    when the application attempts to access an object in memory that has 
    not been initialized, which may corrupt memory in such a way that an 
    attacker could execute arbitrary code in the context of the logged-on
    user.");
      script_set_attribute(attribute:"solution", value:"Apply the Microsoft suggested workaround.");
      script_set_attribute(attribute:"see_also", value:"http://technet.microsoft.com/en-us/security/advisory/2719615");
      script_set_attribute(attribute:"see_also", value:"http://support.microsoft.com/kb/2719615");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'windows/browser/msxml_get_definition_code_exec.rb');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
     
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/06/12");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/06/12");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/06/13");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
      
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
    
      script_dependencies("smb_hotfixes.nasl");
      script_require_ports(139, 445);
      script_require_keys("SMB/Registry/Enumerated");
    
      exit(0);
    }
    
    # This script has been disabled and is intended to be blank.
    # Disabled on 2012/07/10.  Deprecated by smb_nt_ms12-043.nasl.
    exit(0, "Deprecated - replaced by smb_nt_ms12-043.nasl");
    
    include("smb_func.inc");
    include("smb_hotfixes.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_reg_query.inc");
    include("misc_func.inc");
    include("audit.inc");
    
    port   = kb_smb_transport();
    login  = kb_smb_login();
    pass   = kb_smb_password();
    domain = kb_smb_domain();
    
    if (hotfix_check_sp(xp:4, win2003:3, vista:3, win7:2) <= 0) exit(0, 'The host is not affected based on its version / service pack.');
    if ('Windows Embedded' >< get_kb_item_or_exit('SMB/ProductName'))
      audit(AUDIT_INST_VER_NOT_VULN, 'Windows Thin OS');
    
    vuln = 0;
    
    registry_init();
    handle = registry_hive_connect(hive:HKEY_LOCAL_MACHINE, exit_on_fail:TRUE);
    items = make_list(
      "{f300e352-12de-4e7f-ace3-a376874402b6}",
      "{29447369-6968-4e86-a208-603f6f0771a6}",
      "{06b2b7ed-809a-44e6-8538-ca0f5b74ecc4}"
    );
    
    systemroot = hotfix_get_systemroot();
    paths = make_list();
    foreach item (items)
    {
      path = get_registry_value(handle:handle, item:'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDB\\'+item+'\\DatabasePath');
      if (!isnull(path))
        paths = make_list(paths, path);
      else paths = make_list(paths, systemroot+'\\AppPatch\\Custom\\'+item+'.sdb');
    }
    RegCloseKey(handle:handle);
    close_registry(close:FALSE);
    
    # Now make sure the files are in place
    foreach path (paths)
    {
      share = ereg_replace(pattern:'^([A-Za-z]):.*', replace:"\1$", string:path);
      sdb = ereg_replace(pattern:'^[A-Za-z]:(.*)', replace:"\1", string:path);
    
      rc = NetUseAdd(login:login, password:pass, domain:domain, share:share);
      if (rc != 1)
      {
        close_registry(close:FALSE);
        debug_print('Failed to connect to the \''+share+'\'.');
        continue;
      }
    
      fh = CreateFile(
        file:sdb,
        desired_access:GENERIC_READ,
        file_attributes:FILE_ATTRIBUTE_NORMAL,
        share_mode:FILE_SHARE_READ,
        create_disposition:OPEN_EXISTING
      );
      if (isnull(fh))
        vuln++;
      else
        CloseFile(handle:fh);
      close_registry(close:FALSE);
    }
    NetUseDel();
    
    if (vuln)
    {
      security_hole(port:port);
      exit(0);
    }
    else exit(0, 'The host is not affected.');
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS12-043.NASL
    descriptionThe version of Microsoft XML Core Services installed on the remote Windows host is affected by a remote code execution vulnerability that could allow arbitrary code execution if a user views a specially crafted web page using Internet Explorer.
    last seen2020-06-01
    modified2020-06-02
    plugin id59906
    published2012-07-11
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/59906
    titleMS12-043: Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (2722479)

Oval

accepted2014-08-18T04:01:11.689-04:00
classvulnerability
contributors
  • nameSecPod Team
    organizationSecPod Technologies
  • nameChandan S
    organizationSecPod Technologies
  • namePradeep R B
    organizationSecPod Technologies
  • nameMaria Mikhno
    organizationALTX-SOFT
  • nameSaurabh Kumar
    organizationSecPod Technologies
  • nameMaria Mikhno
    organizationALTX-SOFT
definition_extensions
  • commentMicrosoft Office 2007 SP2 is installed
    ovaloval:org.mitre.oval:def:15607
  • commentMicrosoft Office 2007 SP3 is installed
    ovaloval:org.mitre.oval:def:15704
  • commentMicrosoft Expression Web SP1 is installed
    ovaloval:org.mitre.oval:def:15420
  • commentMicrosoft Expression Web 2 is installed
    ovaloval:org.mitre.oval:def:15694
  • commentMicrosoft Office Compatibility Pack SP2 is installed
    ovaloval:org.mitre.oval:def:15640
  • commentMicrosoft Office Compatibility Pack SP3 is installed
    ovaloval:org.mitre.oval:def:15035
  • commentMicrosoft Word Viewer is installed
    ovaloval:org.mitre.oval:def:737
  • commentMicrosoft XML Core Services 5 is installed
    ovaloval:org.mitre.oval:def:493
  • commentMicrosoft XML Core Services 3 is installed
    ovaloval:org.mitre.oval:def:415
  • commentMicrosoft XML Core Services 4 is installed
    ovaloval:org.mitre.oval:def:1002
  • commentMicrosoft XML Core Services 6 is installed
    ovaloval:org.mitre.oval:def:454
  • commentMicrosoft Windows XP (32-bit) is installed
    ovaloval:org.mitre.oval:def:1353
  • commentMicrosoft Windows XP x64 is installed
    ovaloval:org.mitre.oval:def:15247
  • commentMicrosoft Windows Server 2003 (32-bit) is installed
    ovaloval:org.mitre.oval:def:1870
  • commentMicrosoft Windows Server 2003 (x64) is installed
    ovaloval:org.mitre.oval:def:730
  • commentMicrosoft Windows Server 2003 (ia64) Gold is installed
    ovaloval:org.mitre.oval:def:396
  • commentMicrosoft Windows Vista (32-bit) is installed
    ovaloval:org.mitre.oval:def:1282
  • commentMicrosoft Windows Vista x64 Edition is installed
    ovaloval:org.mitre.oval:def:2041
  • commentMicrosoft Windows Server 2008 (32-bit) is installed
    ovaloval:org.mitre.oval:def:4870
  • commentMicrosoft Windows Server 2008 (64-bit) is installed
    ovaloval:org.mitre.oval:def:5356
  • commentMicrosoft Windows Server 2008 (ia-64) is installed
    ovaloval:org.mitre.oval:def:5667
  • commentMicrosoft Windows 7 is installed
    ovaloval:org.mitre.oval:def:12541
  • commentMicrosoft Windows Server 2008 R2 x64 Edition is installed
    ovaloval:org.mitre.oval:def:6438
  • commentMicrosoft Windows Server 2008 R2 Itanium-Based Edition is installed
    ovaloval:org.mitre.oval:def:5954
  • commentMicrosoft Windows 7 (32-bit) is installed
    ovaloval:org.mitre.oval:def:6165
  • commentMicrosoft Windows 7 x64 Edition is installed
    ovaloval:org.mitre.oval:def:5950
  • commentMicrosoft Windows Server 2008 R2 x64 Edition is installed
    ovaloval:org.mitre.oval:def:6438
  • commentMicrosoft Windows Server 2008 R2 Itanium-Based Edition is installed
    ovaloval:org.mitre.oval:def:5954
  • commentMicrosoft Windows 8 is installed
    ovaloval:org.mitre.oval:def:15732
  • commentMicrosoft Windows Server 2012 is installed
    ovaloval:org.mitre.oval:def:16359
descriptionMicrosoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
familywindows
idoval:org.mitre.oval:def:15195
statusaccepted
submitted2012-07-16T12:35:55
titleMSXML Uninitialized Memory Corruption Vulnerability - MS12-043
version83

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/113765/msxml_get_definition_code_exec.rb.txt
idPACKETSTORM:113765
last seen2016-12-05
published2012-06-16
reportersinn3r
sourcehttps://packetstormsecurity.com/files/113765/Microsoft-XML-Core-Services-MSXML-Uninitialized-Memory-Corruption.html
titleMicrosoft XML Core Services MSXML Uninitialized Memory Corruption

Saint

bid53934
descriptionMicrosoft XML Core Services memory corruption
osvdb82873
titlemsxml_memory_corruption
typeclient

Seebug

  • bulletinFamilyexploit
    descriptionCVE ID: CVE-2012-1889 Microsoft XML核心服务(MSXML)允许使用JScript、VBScript和Microsoft Visual Studio 6.0的用户构建可与其他符合XML 1.0标准的应用程序相互操作的XML应用。 Microsoft XML Core Services 3.0、4.0、5.0、6.0在访问未初始化内存位置时存在安全漏洞,可允许远程攻击者通过特制的网站执行任意代码或造成拒绝服务。 0 Microsoft Windows 临时解决方法: 如果您不能立刻安装补丁或者升级,NSFOCUS建议您采取以下措施以降低威胁: * 应用XML Core Services 5.0的Microsoft Fix it解决方案。 * 配置IE,在运行活动脚本时提示或禁用 * 在IE中阻止ActiveX控件 厂商补丁: Microsoft --------- Microsoft已经为此发布了一个安全公告(2719615)以及相应补丁: 2719615:Microsoft XML Core Services 中的漏洞可能允许远程执行代码 链接:http://technet.microsoft.com/zh-cn/security/advisory/2719615
    idSSV:60271
    last seen2017-11-19
    modified2012-07-11
    published2012-07-11
    reporterRoot
    titleMSXML未初始化内存破坏漏洞 (MS12-043)
  • bulletinFamilyexploit
    descriptionCVE ID: CVE-2012-1889 Microsoft XML Core Services (MSXML)是一组服务,可用JScript、VBScript、Microsoft开发工具编写的应用构建基于XML的Windows-native应用。 Microsoft XML Core Services 3.0、4.0、5.0、6.0在实现上存在漏洞,可能导致访问未初始化内存对象进而发生内存破坏,远程攻击者可利用该漏洞在用户通过IE查看恶意网页时执行任意代码。 0 Microsoft XML Core Services 6.0 Microsoft XML Core Services 5.0 Microsoft XML Core Services 4.0 Microsoft XML Core Services 3.0 临时解决方法: 如果您不能立刻安装补丁或者升级,NSFOCUS建议您采取以下措施以降低威胁: *部署Enhanced Mitigation Experience Toolkit(EMET) *配置IE在运行活动脚本之前提示或在IE和本地网络安全区域中禁用活动脚本。 厂商补丁: Microsoft --------- Microsoft已经为此发布了一个安全公告(2719615)以及相应补丁: 2719615:Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution 链接:http://technet.microsoft.com/en-us/security/advisory/2719615
    idSSV:60204
    last seen2017-11-19
    modified2012-06-13
    published2012-06-13
    reporterRoot
    titleMicrosoft XML Core Services远程代码执行漏洞