Signature Detail

HTTP: Microsoft Windows WinVerifyTrust Signature Validation

This signature detects attempts to exploit a known vulnerability against Microsoft Windows Portable Executable (PE) file format. A successful attack can lead to remote code execution.

Extended Description

Microsoft Windows Authenticode Signature Verification is prone to a remote code-execution vulnerability. Attackers can exploit this issue by enticing an unsuspecting victim to run or install a specially modified signed Portable Executable (PE) file. Successful exploits can allow attackers to execute arbitrary code with the privileges of the user running the application. Failed exploit attempts will likely result in denial-of-service conditions.

Affected Products

• Avaya aura_conferencing 6.0 Standard
• Avaya callpilot 4.0
• Avaya callpilot 5.0
• Avaya communication_server_1000_telephony_manager 3.0
• Avaya communication_server_1000_telephony_manager 4.0
• Avaya meeting_exchange 5.0
• Avaya meeting_exchange 5.0.0.0.52
• Avaya meeting_exchange 5.0 SP1
• Avaya meeting_exchange 5.0 SP2
• Avaya meeting_exchange 5.1
• Avaya meeting_exchange 5.1 SP1
• Avaya meeting_exchange 5.2
• Avaya meeting_exchange 5.2 SP1
• Avaya meeting_exchange 5.2 SP2
• Avaya meeting_exchange-client_registration_server
• Avaya meeting_exchange-recording_server
• Avaya meeting_exchange-streaming_server
• Avaya meeting_exchange-web_conferencing_server
• Avaya meeting_exchange-webportal
• Avaya messaging_application_server 5
• Avaya messaging_application_server 5.2
• Microsoft windows_7_for_32-bit_systems SP1
• Microsoft windows_7_for_32-bit_systems
• Microsoft windows_7_for_x64-based_systems SP1
• Microsoft windows_7_for_x64-based_systems
• Microsoft windows_server_2003 SP1
• Microsoft windows_server_2003 SP2
• Microsoft windows_server_2003_enterprise_edition_itanium SP1
• Microsoft windows_server_2003_enterprise_edition_itanium SP1 Beta 1
• Microsoft windows_server_2003_enterprise_edition_itanium SP2
• Microsoft windows_server_2003_enterprise_edition_itanium
• Microsoft windows_server_2003_enterprise_x64_edition SP2
• Microsoft windows_server_2003_enterprise_x64_edition
• Microsoft windows_server_2008_for_32-bit_systems SP2
• Microsoft windows_server_2008_for_32-bit_systems
• Microsoft windows_server_2008_for_itanium-based_systems SP2
• Microsoft windows_server_2008_for_itanium-based_systems
• Microsoft windows_server_2008_for_x64-based_systems R2
• Microsoft windows_server_2008_for_x64-based_systems SP2
• Microsoft windows_server_2008_for_x64-based_systems
• Microsoft windows_server_2008_r2_for_x64-based_systems SP1
• Microsoft windows_server_2008_r2_itanium SP1
• Microsoft windows_server_2008_r2_itanium
• Microsoft windows_vista SP1
• Microsoft windows_vista SP2
• Microsoft windows_vista
• Microsoft windows_vista_x64_edition SP1
• Microsoft windows_vista_x64_edition SP2
• Microsoft windows_vista_x64_edition
• Microsoft windows_xp
• Microsoft windows_xp_home SP1
• Microsoft windows_xp_home SP2
• Microsoft windows_xp_home SP3
• Microsoft windows_xp_home
• Microsoft windows_xp_professional SP1
• Microsoft windows_xp_professional SP2
• Microsoft windows_xp_professional SP3
• Microsoft windows_xp_professional
• Microsoft windows_xp_professional_x64_edition SP2
• Microsoft windows_xp_professional_x64_edition
• Microsoft windows_xp_service_pack_3

References

• BugTraq: 52868
• CVE: CVE-2012-0151