Microsoft XML Core Services CVE-2012-1889 Remote Code Execution Vulnerability
BID:53934
Info
Microsoft XML Core Services CVE-2012-1889 Remote Code Execution Vulnerability
| Bugtraq ID: | 53934 |
| Class: | Unknown |
| CVE: |
CVE-2012-1889 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 12 2012 12:00AM |
| Updated: | Aug 14 2012 10:30PM |
| Credit: | Qihoo 360 Security Center |
| Vulnerable: |
Microsoft XML Core Services 6.0 Microsoft XML Core Services 5.0 Microsoft XML Core Services 4.0 Microsoft XML Core Services 3.0 Avaya Messaging Application Server 5.2 Avaya Messaging Application Server 5 Avaya Meeting Exchange - Webportal 0 Avaya Meeting Exchange - Web Conferencing Server 0 Avaya Meeting Exchange - Streaming Server 0 Avaya Meeting Exchange - Recording Server 0 Avaya Meeting Exchange - Client Registration Server 0 Avaya Conferencing Standard Edition 6.0 SP1 Avaya Conferencing Standard Edition 6.0 Avaya Communication Server 1000 Telephony Manager 4.0 Avaya Communication Server 1000 Telephony Manager 3.0 Avaya CallPilot 5.0 Avaya CallPilot 4.0 |
| Not Vulnerable: | |
Discussion
Microsoft XML Core Services CVE-2012-1889 Remote Code Execution Vulnerability
Microsoft XML Core Services is prone to a remote code-execution vulnerability.
Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial-of-service conditions.
Microsoft XML Core Services versions 3.0, 4.0, 5.0, and 6.0 are affected.
Microsoft XML Core Services is prone to a remote code-execution vulnerability.
Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial-of-service conditions.
Microsoft XML Core Services versions 3.0, 4.0, 5.0, and 6.0 are affected.
Exploit / POC
Microsoft XML Core Services CVE-2012-1889 Remote Code Execution Vulnerability
The vendor reports this issue is actively being exploited in the wild.
The following exploit is available:
The vendor reports this issue is actively being exploited in the wild.
The following exploit is available:
Solution / Fix
Microsoft XML Core Services CVE-2012-1889 Remote Code Execution Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].
Microsoft XML Core Services 6.0
Microsoft XML Core Services 4.0
Microsoft XML Core Services 3.0
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].
Microsoft XML Core Services 6.0
-
Microsoft Security Update for Microsoft XML Core Services 6.0 Service Pack 2 (KB2721693)
http://www.microsoft.com/downloads/details.aspx?familyid=3b56ba48-b74c -4681-8e17-715dc5d45e2c -
Microsoft Security Update for Microsoft XML Core Services 6.0 Service Pack 2 for Itanium-based Systems (KB2721
http://www.microsoft.com/downloads/details.aspx?familyid=68eb373e-2c1e -40db-8ad0-0a369a96255b -
Microsoft Security Update for Microsoft XML Core Services 6.0 Service Pack 2 for x64-based Systems (KB2721693)
http://www.microsoft.com/downloads/details.aspx?familyid=aaf10833-0487 -4026-805b-97543140b1fd -
Microsoft Security Update for Windows 7 (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=d8a4817c-481c -4ed2-980a-21623f0ca6d2 -
Microsoft Security Update for Windows 7 for x64-based Systems (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=e1962879-1725 -4d60-933f-eb351bee56bc -
Microsoft Security Update for Windows Server 2008 (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=42a869b9-085a -450a-b69e-f634d01075dd -
Microsoft Security Update for Windows Server 2008 for Itanium-based Systems (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=359a86d6-e94a -4de5-83d9-6b0273115bff -
Microsoft Security Update for Windows Server 2008 R2 for Itanium-based Systems (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=a745388e-9fef -412e-8d00-9195af506cf5 -
Microsoft Security Update for Windows Server 2008 R2 x64 Edition (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=f75a3d2d-8322 -40a6-b735-faeb8b4873b6 -
Microsoft Security Update for Windows Server 2008 x64 Edition (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=f7b2d780-cc92 -4f3e-b5a2-9f2ac66b6f1c -
Microsoft Security Update for Windows Vista (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=f8ccdb90-66bd -471a-9c78-825d1140b5ac -
Microsoft Security Update for Windows Vista for x64-based Systems (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=e8553934-a202 -4033-b9c5-27bc4207469d -
Microsoft Security Update for Windows XP (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=017f1ed7-eed4 -4de3-aca1-93fb25058866
Microsoft XML Core Services 4.0
-
Microsoft Security Update for Microsoft XML Core Services 4.0 Service Pack 3 (KB2721691)
http://www.microsoft.com/downloads/details.aspx?familyid=c34c2511-84d4 -4f7e-b61a-086e6ee26ffa -
Microsoft Security Update for Microsoft XML Core Services 4.0 Service Pack 3 for Itanium-based Systems (KB2721
http://www.microsoft.com/downloads/details.aspx?familyid=77f45630-288e -46dd-8cb7-c59b07a4bde4 -
Microsoft Security Update for Microsoft XML Core Services 4.0 Service Pack 3 for x64-based Systems (KB2721691)
http://www.microsoft.com/downloads/details.aspx?familyid=91fcc9f2-86ad -47e9-b298-91d74f852c19
Microsoft XML Core Services 3.0
-
Microsoft Security Update for Windows 7 (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=d8a4817c-481c -4ed2-980a-21623f0ca6d2 -
Microsoft Security Update for Windows 7 for x64-based Systems (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=e1962879-1725 -4d60-933f-eb351bee56bc -
Microsoft Security Update for Windows Server 2003 (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=b7321c17-0e8e -4217-8da6-4c270dbfc802 -
Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=eab0f4c6-3f2e -435d-aef7-d9230295ab15 -
Microsoft Security Update for Windows Server 2003 x64 Edition (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=2b24d755-f96f -47d6-b286-2bfd4e278dcc -
Microsoft Security Update for Windows Server 2008 (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=42a869b9-085a -450a-b69e-f634d01075dd -
Microsoft Security Update for Windows Server 2008 for Itanium-based Systems (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=359a86d6-e94a -4de5-83d9-6b0273115bff -
Microsoft Security Update for Windows Server 2008 R2 for Itanium-based Systems (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=a745388e-9fef -412e-8d00-9195af506cf5 -
Microsoft Security Update for Windows Server 2008 R2 x64 Edition (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=f75a3d2d-8322 -40a6-b735-faeb8b4873b6 -
Microsoft Security Update for Windows Server 2008 x64 Edition (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=f7b2d780-cc92 -4f3e-b5a2-9f2ac66b6f1c -
Microsoft Security Update for Windows Vista (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=f8ccdb90-66bd -471a-9c78-825d1140b5ac -
Microsoft Security Update for Windows Vista for x64-based Systems (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=e8553934-a202 -4033-b9c5-27bc4207469d -
Microsoft Security Update for Windows XP (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=017f1ed7-eed4 -4de3-aca1-93fb25058866 -
Microsoft Security Update for Windows XP x64 Edition (KB2719985)
http://www.microsoft.com/downloads/details.aspx?familyid=d27bd5e9-a3a6 -411e-bc50-2b03d64fb50c
References
Microsoft XML Core Services CVE-2012-1889 Remote Code Execution Vulnerability
References:
References:
- Microsoft Windows Homepage (Microsoft )