SMB: Microsoft Windows Crafted File Name Memory Corruption Remote Code Execution
This signature detects attempts to exploit a known flaw in Microsoft Windows CIFS/SMB. Accessing a maliciously-crafted file name could result in memory corruption and possibly arbitrary remote code execution with the privileges of the targeted user.
Extended Description
Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allow remote attackers to execute arbitrary code via a crafted (1) file name or (2) subfolder name that triggers use of unallocated memory as the destination of a copy operation, aka "Windows Filename Parsing Vulnerability."
Affected Products
Microsoft windows_7
Short Name
SMB:FILE:CRAFTED-NAME-RCE
Severity
Major
Recommended
False
Recommended Action
Drop
Category
SMB
Keywords
CVE-2012-4774 Code Corruption Crafted Execution File Memory Microsoft Name Remote Windows bid:56443
Release Date
12/10/2012
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3659
False Positive
Unknown
Vendors
Microsoft
CVSS Score
9.3