CVE-2012-0013

EPSS 73.8%

Incomplete blacklist vulnerability in the Windows Packager configuration in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted ClickOnce application in a Microsoft Office document, related to .application files, aka "Assembly Execution Vulnerability."

Affected products

n/a · n/a

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/19037unverified exploitdbwww.exploit-db.com/exploits/18372unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-005 http://secunia.com/advisories/47480 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14197 http://www.securityfocus.com/bid/51284 http://www.securitytracker.com/id?1026497 http://www.us-cert.gov/cas/techalerts/TA12-010A.html