CVE-2012-1889
published 2012-06-13CVE-2012-1889: Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a…
PriorityP189high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-06-22
Exploited in the wild
EPSS
83.64%
99.7th percentile
Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | xml_core_services | — | — |
| microsoft | xml_core_services | — | — |
| microsoft | xml_core_services | — | — |
| microsoft | xml_core_services | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
SID 23142
snort↗
SID 23143
snort↗
SID 23144
snort↗
SID 23145
snort↗
SID 23146
- →Exploit delivery involved iframe injection into compromised sites redirecting to a dedicated exploit server; monitor for suspicious iframe injections pointing to external domains serving CAB/JAR files ↗
- →A Metasploit module for CVE-2012-1889 was released June 15, 2012, significantly broadening the attacker base; monitor for Metasploit-generated exploit traffic against MSXML ↗
- →Group 72 / Axiom domains follow a pattern of naming after intended victims (companyname.attackerdomain.com or companyacronym.attackerdomain.com); use this naming pattern for proactive domain hunting ↗
- →DeputyDog RAT used campaign codes 'kumanichi' and 'moon'; hunt for these strings in network traffic or malware samples ↗
- →ClamAV signature Win.Trojan.HyDraq covers Hydraq/9002 RAT/McRAT/Naid malware associated with CVE-2012-1889 exploitation campaigns ↗
- →Google was issuing warnings to potential victims in Gmail about CVE-2012-1889 exploitation at least since June 5, 2012, indicating early targeted exploitation before public disclosure ↗
- ·The Recorded Future report lists two slightly different IP addresses for the same C&C node in different parts of the article (58.64.143.244 vs 58.65.143.244); verify the correct address before blocking ↗
- ·Snort SIDs 23142–23146 for CVE-2012-1889 are described as 'extremely generic in relation to the vulnerability' and were designed to cover all known and future exploit variants; tune carefully to avoid false positives ↗
- ·The Zscaler blog post for CVE-2012-1889 appears to have had most of its technical content stripped from the scraped version; only two IOC domains (Js.users.51.la and Web1.51.la:82) were recoverable ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck8.8HIGH
cisa8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hv88-2gcv-6mjq: Microsoft XML Core Services 3
ghsa_unreviewed·2022-05-13
CVE-2012-1889 [HIGH] CWE-119 GHSA-hv88-2gcv-6mjq: Microsoft XML Core Services 3
Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
VulnCheck
Microsoft XML Core Services Memory Corruption Vulnerability
vulncheck·2012·CVSS 8.8
CVE-2012-1889 [HIGH] CWE-119 Microsoft XML Core Services Memory Corruption Vulnerability
Microsoft XML Core Services Memory Corruption Vulnerability
Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution.
Affected: Microsoft XML Core Services
Required Action: Apply updates per vendor instructions.
Exploitation References: http://www.cs.cornell.edu/courses/cs6410/2012fa/slides/Symantec_ElderwoodProject_2012.pdf; https://cisa.gov/news-events/alerts/2012/06/13/microsoft-releases-security-advisory-microsoft-xml-core-services; https://cisa.gov/news-events/alerts/2012/06/22/microsoft-xml-core-services-attack-activity; https://cybersecurity.att.com/blogs/labs-research/new-sykipot-developments; https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/hidden_lynx.pdf; https://www.recordedfuture.com/hidden-lynx-a
CISA
Microsoft XML Core Services Memory Corruption Vulnerability
cisa·2022-06-08·CVSS 8.8
CVE-2012-1889 [HIGH] CWE-119 Microsoft XML Core Services Memory Corruption Vulnerability
Vulnerability: Microsoft XML Core Services Memory Corruption Vulnerability
Affected: Microsoft XML Core Services
Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2012-1889
Remediation Due Date: 2022-06-22
Suricata
ET WEB_CLIENT Potential MSXML2.FreeThreadedDOMDocument Uninitialized Memory Corruption Attempt
suricata·2012-07-10
CVE-2012-1889 ET WEB_CLIENT Potential MSXML2.FreeThreadedDOMDocument Uninitialized Memory Corruption Attempt
ET WEB_CLIENT Potential MSXML2.FreeThreadedDOMDocument Uninitialized Memory Corruption Attempt
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Potential MSXML2.FreeThreadedDOMDocument Uninitialized Memory Corruption Attempt"; flow:established,to_client; file.data; content:"f6d90f12-9c73-11d3-b32e-00c04f990bb4"; fast_pattern; nocase; content:"definition"; nocase; pcre:"/clsid\s*\x3a\s*\x7B?\s*f6d90f12-9c73-11d3-b32e-00c04f990bb4/si"; pcre:"/(?:\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\(/"; reference:cve,2012-1889; classtype:attempted-user; sid:2015557; rev:8; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2012_07_10, cve CVE_2012_1889, deployment Perimeter, confidence Medium, signa
Exploit-DB
Microsoft XML Core Services - MSXML Uninitialized Memory Corruption (MS12-043) (Metasploit)
exploitdb·2012-06-16
CVE-2012-1889 Microsoft XML Core Services - MSXML Uninitialized Memory Corruption (MS12-043) (Metasploit)
Microsoft XML Core Services - MSXML Uninitialized Memory Corruption (MS12-043) (Metasploit)
---
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 HttpClients::IE,
:ua_minver => "6.0",
:ua_maxver => "9.0",
:javascript => true,
:os_name => OperatingSystems::WINDOWS,
:classid => "{f6D90f11-9c73-11d3-b32e-00C04f990bb4}",
:method => "definition",
:rank => GoodRanking
})
def initialize(info={})
super(update_info(info,
'Name' => "MS12-043 Microsoft XML Core Services MSXML Uninitialized Memory Corruption",
'Description' => %q{
This module exploits a memory corruption flaw in Microsoft XML Core Services
when trying to access an uninitialized Node with the getDefinition API
Metasploit
MS12-043 Microsoft XML Core Services MSXML Uninitialized Memory Corruption
metasploit
MS12-043 Microsoft XML Core Services MSXML Uninitialized Memory Corruption
MS12-043 Microsoft XML Core Services MSXML Uninitialized Memory Corruption
This module exploits a memory corruption flaw in Microsoft XML Core Services when trying to access an uninitialized Node with the getDefinition API, which may corrupt memory allowing remote code execution.
Unit42
Web-Based Threats: First Half 2019
blogs_unit42·2019-11-01
Web-Based Threats: First Half 2019
Threat Research Center
Trend Reports
Malware
## Web-Based Threats: First Half 2019
Fang Liu
Tao Yan
Jin Chen
Rongbo Shao
Zhanglin He
Bo Qu
Published: November 1, 2019
Malware
Trend Reports
Vulnerabilities
ELink
Exploit Kits
Malicious Domains
Malicious URL
Phishing
## Executive Summary
Our Unit 42 research team routinely evaluates the data from our Email Link Analysis (ELINK) system . In examining the data we collect, which includes URLs extracted from emails or submitted by API, we can identify patterns and trends which helps us discern prevalent web threats. This blog is the fifth installment in a series of posts tracking web-based threats over time, specifically, statistics pertaining to malicious URLs, domains, exploit kits, vulnerabilities, and phishing scams.
Unit42
Web-Based Threats: First Half 2019
blogs_unit42·2019-11-01
Web-Based Threats: First Half 2019
# Executive Summary
Our Unit 42 research team routinely evaluates the data from our Email Link Analysis (ELINK) system. In examining the data we collect, which includes URLs extracted from emails or submitted by API, we can identify patterns and trends which helps us discern prevalent web threats. This blog is the fifth installment in a series of posts tracking web-based threats over time, specifically, statistics pertaining to malicious URLs, domains, exploit kits, vulnerabilities, and phishing scams.
We observed a significant decrease in the activity of the Fallout exploit kit in the first quarter of 2019 while at the same time observing an increase in activity of the Kaixin exploit kit in the second quarter. Kaixin is primarily observed hosted in China and with the increased popularit
Unit42
Web-based Threats-2018 Q3: Malicious URLs and Domains take a Dip
blogs_unit42·2018-12-27·CVSS 9.8
[CRITICAL] Web-based Threats-2018 Q3: Malicious URLs and Domains take a Dip
# Executive Summary
Our Email Link Analysis (ELINK) system is routinely reviewed by our Unit 42 research team. In examining the data it collects, patterns and trends are discovered which helps us discern prevalent web threats. This blog is the third (3rd quarter of 2018) in a series of posts tracking web-based threats throughout the year, specifically statistics pertaining to malicious URLs, domains, exploit kits, and CVEs.
During Quarter 3 (Q3), July – September, a notable shift occurred with the malicious URL and domain data; there was a significant drop in the number of malicious URLs as well as a drop in malicious domains that will be discussed below. In addition, we will be covering an interesting malicious Flash SWF that exploits CVE-2015-5119.
# URLs
Based on our analysis of dat
Unit42
Web-based Threats-2018 Q3: Malicious URLs and Domains take a Dip
blogs_unit42·2018-12-27·CVSS 9.8
CVE-2015-5119 [CRITICAL] Web-based Threats-2018 Q3: Malicious URLs and Domains take a Dip
Threat Research Center
Trend Reports
Malware
## Web-based Threats-2018 Q3: Malicious URLs and Domains take a Dip
Bo Qu
Tao Yan
Rongbo Shao
Zhanglin He
Xingyu Jin
Published: December 27, 2018
Malware
Trend Reports
Vulnerabilities
CVE-2015-5119
ELink
## Executive Summary
Our Email Link Analysis (ELINK) system is routinely reviewed by our Unit 42 research team. In examining the data it collects, patterns and trends are discovered which helps us discern prevalent web threats. This blog is the third (3rd quarter of 2018) in a series of posts tracking web-based threats throughout the year, specifically statistics pertaining to malicious URLs, domains, exploit kits, and CVEs.
During Quarter 3 (Q3), July – September, a notable shift occurred with the malicious URL and domain d
Talos
Threat Spotlight: Group 72
blogs_talos·2014-10-14
Threat Spotlight: Group 72
This post is co-authored by Joel Esler, Martin Lee and Craig Williams.
Everyone has certain characteristics that can be recognised. This may be a way of walking, an accent, a turn of phrase or a style of dressing. If you know what to look for you can easily spot a friend or acquaintance in a crowd by knowing what characteristics to look for. Exactly the same is true for threat actors.
Each threat actor group may have certain characteristics that they display during their attack campaigns. These may be the types of malware that they use, a pattern in the naming conventions of their command and control servers, their choice of victims etc. Collecting attack data allows an observer to spot the characteristics that define each group and identify specific threat actors from the crowd of malici
Talos
Threat Spotlight: Group 72
blogs_talos·2014-10-14
Threat Spotlight: Group 72
## Threat Spotlight: Group 72
This post is co-authored by Joel Esler , Martin Lee and Craig Williams. Everyone has certain characteristics that can be recognised. This may be a way of walking, an accent, a turn of phrase or a style of dressing. If you know what to look for you can easily spot a friend or acquaintance in a crowd by knowing what characteristics to look for. Exactly the same is true for threat actors.
Each threat actor group may have certain characteristics that they display during their attack campaigns. These may be the types of malware that they use, a pattern in the naming conventions of their command and control servers, their choice of victims etc. Collecting attack data allows an observer to spot the characteristics that define each group and identify specific threat
Zscaler
CVE-2012-1889 Is Still Alive! | Zscaler
blogs_zscaler·2013-11-07·CVSS 8.8
[HIGH] CVE-2012-1889 Is Still Alive! | Zscaler
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Krebs
In a Zero-Day World, It’s Active Attacks that Matter – Krebs on Security
blogs_krebs·2012-10-01
In a Zero-Day World, It’s Active Attacks that Matter – Krebs on Security
The recent zero-day vulnerability in Internet Explorer caused many (present company included) to urge Internet users to consider surfing the Web with a different browser until Microsoft issued a patch. Microsoft did so last month, but not before experts who ought to have known better began downplaying such advice, pointing out that other browser makers have more vulnerabilities and just as much exposure to zero-day flaws.
This post examines hard data that shows why such reasoning is more emotional than factual. Unlike Google Chrome and Mozilla Firefox users, IE users were exposed to active attacks against unpatched, critical vulnerabilities for months at a time over the past year and a half.
Attackers exploited zero-day holes in Internet Explorer for at least 89 days over the past 19 mon
Krebs
In a Zero-Day World, It’s Active Attacks that Matter
blogs_krebs·2012-10-01
In a Zero-Day World, It’s Active Attacks that Matter
The recent zero-day vulnerability in Internet Explorer caused many (present company included) to urge Internet users to consider surfing the Web with a different browser until Microsoft issued a patch. Microsoft did so last month, but not before experts who ought to have known better began downplaying such advice, pointing out that other browser makers have more vulnerabilities and just as much exposure to zero-day flaws.
This post examines hard data that shows why such reasoning is more emotional than factual. Unlike Google Chrome and Mozilla Firefox users, IE users were exposed to active attacks against unpatched, critical vulnerabilities for months at a time over the past year and a half.
Attackers exploited zero-day holes in Internet Explorer for at least 89 days over the past 19 mon
Krebs
Espionage Hackers Target ‘Watering Hole’ Sites
blogs_krebs·2012-09-25
Espionage Hackers Target ‘Watering Hole’ Sites
Security experts are accustomed to direct attacks, but some of today’s more insidious incursions succeed in a roundabout way — by planting malware at sites deemed most likely to be visited by the targets of interest. New research suggests these so-called “watering hole” tactics recently have been used as stepping stones to conduct espionage attacks against a host of targets across a variety of industries, including the defense, government, academia, financial services, healthcare and utilities sectors.
Espionage attackers increasingly are setting traps at “watering hole” sites, those frequented by individuals and organizations being targeted.
Some of the earliest details of this trend came in late July 2012 from RSA FirstWatch, which warned of an increasingly common attack technique invo
Krebs
Espionage Hackers Target ‘Watering Hole’ Sites – Krebs on Security
blogs_krebs·2012-09-01
Espionage Hackers Target ‘Watering Hole’ Sites – Krebs on Security
Security experts are accustomed to direct attacks, but some of today’s more insidious incursions succeed in a roundabout way — by planting malware at sites deemed most likely to be visited by the targets of interest. New research suggests these so-called “watering hole” tactics recently have been used as stepping stones to conduct espionage attacks against a host of targets across a variety of industries, including the defense, government, academia, financial services, healthcare and utilities sectors.
Espionage attackers increasingly are setting traps at “watering hole” sites, those frequented by individuals and organizations being targeted.
Some of the earliest details of this trend came in late July 2012 from RSA FirstWatch, which warned of an increasingly common attack technique invo
Talos
Microsoft In-The-Wild Coverage - CVE-2012-1889 and CVE-2012-1875
blogs_talos·2012-06-21·CVSS 9.3
[CRITICAL] Microsoft In-The-Wild Coverage - CVE-2012-1889 and CVE-2012-1875
As a security professional, there's very little I hate more than Microsoft vulnerabilities announced after patches are sent out each Microsoft Tuesday. Not only do they mean that folks like me have to scramble to address them - since invariably bugs released outside the standard patch cycle come with live exploits - they typically grant the largest possible exploitation window to an attacker. If your job is to keep systems secure, a potentially month-long window between exploit code release and patch release is a nightmare.
This month brought that exact scenario, with the public release of CVE-2012-1889 mere hours after the release of the month's patches. The vulnerability has been actively exploited in the wild for some time before this public release; Google has been issuing warnings to
Talos
Microsoft In-The-Wild Coverage - CVE-2012-1889 and CVE-2012-1875
blogs_talos·2012-06-21·CVSS 9.3
CVE-2012-1889 [CRITICAL] Microsoft In-The-Wild Coverage - CVE-2012-1889 and CVE-2012-1875
## Microsoft In-The-Wild Coverage - CVE-2012-1889 and CVE-2012-1875
As a security professional, there's very little I hate more than Microsoft vulnerabilities announced after patches are sent out each Microsoft Tuesday. Not only do they mean that folks like me have to scramble to address them - since invariably bugs released outside the standard patch cycle come with live exploits - they typically grant the largest possible exploitation window to an attacker. If your job is to keep systems secure, a potentially month-long window between exploit code release and patch release is a nightmare.
This month brought that exact scenario, with the public release of CVE-2012-1889 mere hours after the release of the month's patches. The vulnerability has been actively exploited in the wild for some
Recorded Future
Uncovering Hidden Lynx: Using OSINT for APT Analysis
blogs_recorded_future
Uncovering Hidden Lynx: Using OSINT for APT Analysis
# Hunting Hidden Lynx: How OSINT is Crucial for APT Analysis
### Analysis Summary
- Visualization of open source intelligence on APTs reveals overlapping infrastructure, tools, and exploits used in the VOHO campaign and Operations Aurora, DeputyDog, and Ephemeral Hydra.
- Two vulnerabilities were identified as exploited by Hidden Lynx in its VOHO campaign (2012) and the Elderwood Gang responsible for Operation Aurora (2010). Command and control infrastructure was also shared between Hidden Lynx and threat actors responsible for two campaigns during 2013: Operation DeputyDog and Operation Ephemeral Hydra.
- Threat intelligence derived from disparate open web sources bolsters security efforts by identifying and contextualizing links between threat actors.
When the_New York Times_ and Mand
Zscaler
Zscaler Protects against Microsoft's Patch Cycle | Round 7
blogs_zscaler
Zscaler Protects against Microsoft's Patch Cycle | Round 7
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Zscaler
Zscaler Protects against Microsoft's Patch Cycle | Round 8
blogs_zscaler·CVSS 9.3
[CRITICAL] Zscaler Protects against Microsoft's Patch Cycle | Round 8
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Threat Intel
Axiom (Axiom, Group 72)
threat_intel·CVSS 8.8
[HIGH] Axiom (Axiom, Group 72)
# Threat Actor Profile: Axiom
ATT&CK ID: G0001
Also known as: Axiom, Group 72
Suspected origin: China
## Overview
Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.(Citation: Kaspersky Winnti April 2013)(Citation: Kaspersky Winnti June 2015)(Citation: Novetta Winnti April 2015)
## Techniques (TTPs)
### Resource Development
- T1584.005 Botnet
Usage: Axiom has used large groups of compromised machines for use as proxy nodes.(Citation: Novetta-Axiom)
- T1583.002 DNS Server
Usage: Axiom has acquired dynamic DNS ser
Recorded Future
Uncovering Hidden Lynx: Using OSINT for APT Analysis | Recorded Future
blogs_recorded_future
Uncovering Hidden Lynx: Using OSINT for APT Analysis | Recorded Future
## Hunting Hidden Lynx: How OSINT is Crucial for APT Analysis
## Analysis Summary
Visualization of open source intelligence on APTs reveals overlapping infrastructure, tools, and exploits used in the VOHO campaign and Operations Aurora, DeputyDog, and Ephemeral Hydra.
Two vulnerabilities were identified as exploited by Hidden Lynx in its VOHO campaign (2012) and the Elderwood Gang responsible for Operation Aurora (2010). Command and control infrastructure was also shared between Hidden Lynx and threat actors responsible for two campaigns during 2013: Operation DeputyDog and Operation Ephemeral Hydra.
Threat intelligence derived from disparate open web sources bolsters security efforts by identifying and contextualizing links between threat actors.
When the_New York Times_ and Mandiant
arXiv
Investigation of Advanced Persistent Threats Network-based Tactics, Techniques and Procedures
arxiv_fulltext·2025-02-12
Investigation of Advanced Persistent Threats Network-based Tactics, Techniques and Procedures
Investigation of Advanced Persistent Threats Network-based Tactics, Techniques and Procedures
Almuthanna Alageel
and
Sergio Maffeis
Department of Computing
Imperial College London
London, United Kingdom
plain
plain
## Abstract
The scarcity of data and the high complexity of Advanced Persistent Threats (APTs) attacks have created challenges in comprehending their behavior and hindered the exploration of effective detection techniques.
To create an effective APT detection strategy, it is important to examine the Tactics, Techniques, and Procedures (TTPs) that have been reported by the industry. These TTPs can be difficult to classify as either malicious or legitimate. When developing an approach for the next generation of network intrusion detection systems (NIDS), it is necessary to
http://technet.microsoft.com/security/advisory/2719615http://www.us-cert.gov/cas/techalerts/TA12-174A.htmlhttp://www.us-cert.gov/cas/techalerts/TA12-192A.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-043https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15195http://technet.microsoft.com/security/advisory/2719615http://www.us-cert.gov/cas/techalerts/TA12-174A.htmlhttp://www.us-cert.gov/cas/techalerts/TA12-192A.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-043https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15195https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1889
2012-06-13
Published
2022-06-08
Added to CISA KEV
Exploited in the wild