CVE-2009-2512

Description

The Web Services on Devices API (WSDAPI) in Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 does not properly process the headers of WSD messages, which allows remote attackers to execute arbitrary code via a crafted (1) message or (2) response, aka Web Services on Devices API Memory Corruption Vulnerability.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

39.904

Associated Vulnerability

Vulnerability	OS Platform
Security Update for Windows Vista (KB973565) x86 based systems	Windows
Security Update for Windows Vista (KB973565) x86 based systems for SP1	Windows
Security Update for Windows Vista (KB973565) x86 based systems for SP2	Windows
Security Update for Windows Server 2008 (KB973565) x86 based systems	Windows
Security Update for Windows Server 2008 (KB973565) x86 based systems for SP2	Windows
Security Update for Windows Vista for x64-based Systems (KB973565)	Windows
Security Update for Windows Vista for x64-based Systems (KB973565) for SP1	Windows
Security Update for Windows Vista for x64-based Systems (KB973565) for SP2	Windows
Security Update for Windows Server 2008 x64 Edition (KB973565)	Windows
Security Update for Windows Server 2008 x64 Edition (KB973565) for SP2	Windows

Patch Details

Click to see the patches provided by ManageEngine for this CVE

Patch ID	Patch Description
PATCH-7848	Security Update for Windows Server 2008 (KB973565)
PATCH-7849	Security Update for Windows Server 2008 (KB973565)
PATCH-7850	Security Update for Windows Vista for x64-based Systems (KB973565)
PATCH-7852	Security Update for Windows Vista for x64-based Systems (KB973565)
PATCH-7853	Security Update for Windows Server 2008 x64 Edition (KB973565)
PATCH-7854	Security Update for Windows Server 2008 x64 Edition (KB973565)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234