CVE-2012-0151
Published: 10 April 2012
Summary
CVE-2012-0151 is a high-severity Improper Input Validation (CWE-20) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-14 (Signed Components) and SI-7 (Software, Firmware, and Information Integrity).
Deeper analysis
The vulnerability is an improper input validation flaw (CWE-20) in the Authenticode Signature Verification function, also known as WinVerifyTrust, that fails to correctly validate the digest of a signed portable executable (PE) file. It affects Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview.
User-assisted remote attackers can exploit the issue by supplying a modified signed PE file containing additional content, resulting in arbitrary code execution on the target system. The attack requires local access with user interaction and carries a CVSS 3.1 score of 7.8 with high impact on confidentiality, integrity, and availability.
Microsoft Security Bulletin MS12-024, along with US-CERT TA12-101A and related advisories, addresses the flaw through available patches that correct the signature validation logic in the affected Windows components.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2012-0189
Vulnerability details
The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview does not properly…
more
validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute arbitrary code via a modified file with additional content, aka "WinVerifyTrust Signature Validation Vulnerability."
- CWE(s)
- KEV Date Added
- 08 June 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires cryptographic verification of software integrity, which is the exact Authenticode/WinVerifyTrust digest check that CVE-2012-0151 bypasses.
Mandates cryptographic authentication of signed components before execution or installation, directly blocking the tampered-PE attack vector.
Requires validation of inputs to security functions; the flawed digest check is an instance of missing input validation on signed PE content.