CVE-2009-2512: Code Injection
First published: Wed Nov 11 2009(Updated: )
The Web Services on Devices API (WSDAPI) in Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 does not properly process the headers of WSD messages, which allows remote attackers to execute arbitrary code via a crafted (1) message or (2) response, aka "Web Services on Devices API Memory Corruption Vulnerability."
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Windows Server | ||
| Microsoft Windows Server | ||
| Microsoft Windows Server | ||
| Microsoft Windows Server | =sp2 | |
| Microsoft Windows Server | =sp2 | |
| Microsoft Windows Server | =sp2 | |
| Microsoft Windows Vista | ||
| Microsoft Windows Vista | ||
| Microsoft Windows Vista | =sp1 | |
| Microsoft Windows Vista | =sp2 | |
| Microsoft Windows Vista | =sp1 | |
| Microsoft Windows Vista | =sp2 | |
| Microsoft Windows Vista | =sp1 | |
| Microsoft Windows Vista | =sp2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2009-2512?
CVE-2009-2512 is considered critical, as it allows remote attackers to execute arbitrary code.
How do I fix CVE-2009-2512?
To mitigate CVE-2009-2512, apply the security updates provided by Microsoft in their bulletin MS09-063.
Which software versions are affected by CVE-2009-2512?
CVE-2009-2512 affects Windows Vista and Windows Server 2008 including service packs SP1 and SP2.
What types of attacks can be executed using CVE-2009-2512?
Remote attackers can exploit CVE-2009-2512 via crafted WSD messages to execute arbitrary code on the affected systems.
Are there any workarounds for CVE-2009-2512?
While applying updates is the best course of action, temporarily restricting the WSDAPI functionality may reduce risk until updates can be installed.
- agent/author
- agent/type
- agent/references
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/nvd-historical
- vendor/microsoft
- canonical/microsoft windows server
- version/microsoft windows server/sp2
- canonical/microsoft windows vista
- version/microsoft windows vista/sp1
- version/microsoft windows vista/sp2