cbcvebase.
CVE-2012-0152
published 2012-03-13

CVE-2012-0152: The Remote Desktop Protocol (RDP) service in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to cause a denial…

PriorityP272medium4.3CVSS 2.0
AVNACMAuNCNINAP
ITWVulnCheck KEV
Exploited in the wild
EPSS
86.33%
99.7th percentile
The Remote Desktop Protocol (RDP) service in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to cause a denial of service (application hang) via a series of crafted packets, aka "Terminal Server Denial of Service Vulnerability."

Affected

1 ranges
VendorProductVersion rangeFixed in
microsoftwindows_server_2008——

Detection & IOCsextracted from sources · hover to see the quote

port3389
snort
alert tcp $HOME_NET 3389 -> any any (msg:"ET DOS Microsoft Remote Desktop (RDP) Syn/Ack Outbound Flowbit Set"; flow:from_server; flowbits:isnotset,ms.rdp.synack; flowbits:set,ms.rdp.synack; flowbits:noalert; flags:SA; reference:cve,2012-0152; classtype:not-suspicious; sid:2014385; rev:6; metadata:created_at 2012_03_15, cve CVE_2012_0152, signature_severity Major, updated_at 2024_03_14;)
  • →Monitor for SYN/ACK packets outbound from RDP service on TCP port 3389 — the Snort/Suricata flowbit 'ms.rdp.synack' tracks this as the first stage of CVE-2012-0152 DoS detection.
  • →The exploit targets the Remote Desktop Protocol (RDP) service; look for a series of crafted packets causing application hang on Windows Server 2008 R2 and Windows 7 systems. ↗
  • ·The Snort rule (sid:2014385) uses 'flowbits:noalert' — it sets the 'ms.rdp.synack' flowbit silently and is intended to be paired with a follow-on rule that fires the actual alert; deploying this rule alone will not generate alerts.

CVSS provenance

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
vulncheck4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.