CVE-2009-2512: Code Injection
The Web Services on Devices API (WSDAPI) in Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 does not properly process the headers of WSD messages, which allows remote attackers to execute arbitrary code via a crafted (1) message or (2) response, aka "Web Services on Devices API Memory Corruption Vulnerability."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2512?
CVE-2009-2512 is considered critical, as it allows remote attackers to execute arbitrary code.
How do I fix CVE-2009-2512?
To mitigate CVE-2009-2512, apply the security updates provided by Microsoft in their bulletin MS09-063.
Which software versions are affected by CVE-2009-2512?
CVE-2009-2512 affects Windows Vista and Windows Server 2008 including service packs SP1 and SP2.
What types of attacks can be executed using CVE-2009-2512?
Remote attackers can exploit CVE-2009-2512 via crafted WSD messages to execute arbitrary code on the affected systems.
Are there any workarounds for CVE-2009-2512?
While applying updates is the best course of action, temporarily restricting the WSDAPI functionality may reduce risk until updates can be installed.