CVE-2012-0152

published 2012-03-13

CVE-2012-0152: The Remote Desktop Protocol (RDP) service in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to cause a denial…

Priority P3 35 medium 4.3 CVSS 2.0

AV N AC M Au N C N I N A P

The Remote Desktop Protocol (RDP) service in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to cause a denial of service (application hang) via a series of crafted packets, aka "Terminal Server Denial of Service Vulnerability."

Affected

1 ranges

Vendor	Product	Version range	Fixed in
microsoft	windows_server_2008	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 3389

snort

alert tcp $HOME_NET 3389 -> any any (msg:"ET DOS Microsoft Remote Desktop (RDP) Syn/Ack Outbound Flowbit Set"; flow:from_server; flowbits:isnotset,ms.rdp.synack; flowbits:set,ms.rdp.synack; flowbits:noalert; flags:SA; reference:cve,2012-0152; classtype:not-suspicious; sid:2014385; rev:6; metadata:created_at 2012_03_15, cve CVE_2012_0152, signature_severity Major, updated_at 2024_03_14;)

• → Monitor for SYN/ACK packets outbound from RDP service on TCP port 3389 — the Snort/Suricata flowbit 'ms.rdp.synack' tracks this as the first stage of CVE-2012-0152 DoS detection.
• → The exploit targets the Remote Desktop Protocol (RDP) service; look for a series of crafted packets causing application hang on Windows Server 2008 R2 and Windows 7 systems. ↗

• · The Snort rule (sid:2014385) uses 'flowbits:noalert' — it sets the 'ms.rdp.synack' flowbit silently and is intended to be paired with a follow-on rule that fires the actual alert; deploying this rule alone will not generate alerts.

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20