(MS12-056) Vulnerability in JScript and VBScript Engines Could Allow Remote Code Execution (2706045)

Publish date: August 15, 2012

Severity: HIGH

CVE Identifier: CVE-2012-2523

Advisory Date: AUG 15, 2012

DESCRIPTION

This bulletin resolves a remote code execution vulnerability found in the scripting engines JScript and VBScript in Windows 64-bit systems. The vulnerability exists in the way the said scripting engines calculate the size of copied objects. Microsoft recommends users to enable prompts for Active Scripting in Internet Explorer.

SOLUTION

PATCH: http://technet.microsoft.com/en-us/security/bulletin/ms12-056

AFFECTED SOFTWARE AND VERSION

JScript 5.8 and VBScript 5.8 (Windows XP Professional x64 Edition Service Pack 2)
JScript 5.8 and VBScript 5.8 (Windows Server 2008 R2 for Itanium-based Systems)
JScript 5.8 and VBScript 5.8 (Windows Server 2008 R2 for Itanium-based Systems Service Pack 1)
JScript 5.8 and VBScript 5.8 (Windows Server 2003 x64 Edition Service Pack 2)
JScript 5.8 and VBScript 5.8 (Windows Vista x64 Edition Service Pack 2)
JScript 5.8 and VBScript 5.8 (Windows Server 2008 for x64-based Systems Service Pack 2)
JScript 5.8 and VBScript 5.8 (Windows 7 for x64-based Systems)
JScript 5.8 and VBScript 5.8 (Windows 7 for x64-based Systems Service Pack 1)
JScript 5.8 and VBScript 5.8 (Windows Server 2008 R2 for x64-based Systems)
JScript 5.8 and VBScript 5.8 (Windows Server 2008 R2 for x64-based Systems Service Pack 1)

Featured Stories

View All

$hacker machine interface$
The State of SCADA HMI Vulnerabilities
A complete discussion of the different vulnerability categories, including case studies of vulnerable SCADA HMIs. The paper also provides a guide for vulnerability researchers, as well as vendors on quick and efficient bug discovery.
Read more
Rogue Robots: Testing the Limits of an Industrial Robot’s Security
The modern world relies heavily on industrial robots. But is the current robotics ecosystem secure enough to withstand a cyber attack?
Read more
$two years of pawn storm$
From Espionage to Cyber Propaganda: Pawn Storm's Activities over the Past Two Years
This paper takes a look at Pawn Storm's operations within the last two years, and how the group has expanded their activities from espionage to the use of cyber propaganda tactics.
Read more
$securing home routers$
Securing Your Routers Against Mirai and Other Home Network Attacks
Cybercriminals can turn unsecure home routers into slaves for their botnets or even abuse them to steal banking credentials. Know about your router’s hidden weaknesses and the many ways you can defend your homes and businesses against these threats.
Read more