Detections
Analytics
MS12-022: Vulnerability in Expression Design Could Allow Remote Code Execution (2651018)
high Nessus Plugin ID 58334
Language:
Synopsis
The Microsoft Expression Design install on the remote Windows host could allow arbitrary code execution.Description
The version of Microsoft Expression Design installed on the remote host is reportedly affected by an insecure library loading vulnerability.A remote attacker could exploit this flaw by tricking a user into opening a legitimate .xpr or .DESIGN file located in the same directory as a maliciously crafted dynamic link library (DLL) file, resulting in arbitrary code execution.
Solution
Microsoft has released a patch for Expression Design.See Also
https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2012/ms12-022
Plugin Details
Severity: High
ID: 58334
File Name: smb_nt_ms12-022.nasl
Version: 1.14
Type: local
Agent: windows
Family: Windows : Microsoft Bulletins
Published: 3/13/2012
Updated: 11/15/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 7.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:microsoft:expression_design
Required KB Items: SMB/MS_Bulletin_Checks/Possible
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 3/13/2012
Vulnerability Publication Date: 3/13/2012
Exploitable With
Core Impact
Reference Information
CVE: CVE-2012-0016
BID: 52375