CVE-2012-0151
Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability
Description
CVE-2012-0151 is a vulnerability in the Microsoft Windows Authenticode Signature Verification function (WinVerifyTrust) that allows user-assisted remote attackers to execute arbitrary code. The flaw occurs because WinVerifyTrust does not properly validate the digest of a signed portable executable (PE) file, enabling an attacker to modify a signed executable while maintaining its apparent valid signature. A victim who downloads and runs the tampered file believes it is legitimately signed, when in fact it executes attacker-controlled code. CISA has added CVE-2012-0151 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 89.0% (99th percentile), this vulnerability poses a critical risk.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 7 | - |
| microsoft | windows server 2003 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows vista | - |
| microsoft | windows xp | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://osvdb.org/81135(Broken Link)
- http://secunia.com/advisories/48581(Broken Link)
- http://www.securitytracker.com/id?1026906(Broken Link, Third Party Advisory, VDB Entry)
- http://www.us-cert.gov/cas/techalerts/TA12-101A.html(Third Party Advisory, US Government Resource)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-024(Patch, Vendor Advisory)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15594(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0151(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
CVE-2012-0151 exploits improper input validation in the Windows Authenticode signature verification process, where the WinVerifyTrust function fails to properly validate the digest of a signed portable executable file. This allows an attacker to modify the executable content while preserving the digital signature, bypassing the trust model that users and systems rely on to verify software authenticity.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2012-0151 undermines a fundamental Windows security mechanism — Authenticode signature verification — which is used to establish trust in software distributed over the internet. The attack requires user interaction (the victim must download and execute a tampered file), but the social engineering barrier is low because the file appears to be legitimately signed. Once executed, the attacker gains code execution with the privileges of the running user, placing confidentiality, integrity, and availability at full risk. The vulnerability is particularly dangerous because it erodes the trust chain that enterprises and individuals rely on to distinguish legitimate software from malware. The EPSS score of 89.0% (99th percentile) indicates near-certain exploitation activity, making this a critical priority for patching.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2012-0151 in the wild by adding it to the Known Exploited Vulnerabilities catalog on June 8, 2022, with a remediation deadline of June 22, 2022. The EPSS score of 89.0% places this vulnerability in the 99th percentile, indicating an extremely high probability of exploitation. This vulnerability was notably exploited by the Flame malware — a sophisticated state-sponsored cyberweapon — which used the Authenticode bypass to sign malicious code with certificates that appeared to originate from Microsoft. No specific ransomware association has been reported, but the ability to bypass signature verification makes this vulnerability exceptionally valuable for advanced persistent threat actors and supply chain attacks.
Remediation
- Apply Microsoft security updates immediately: Install the relevant Windows patches that correct the WinVerifyTrust digest validation flaw, as directed by the CISA KEV required action.
- Enable strict Authenticode signature validation: Configure Windows to enforce strict PE signature verification, ensuring that any modification to a signed executable invalidates the signature. Microsoft released a Security Advisory (2718704) with optional hardening measures.
- Implement application whitelisting: Deploy application control policies (AppLocker or Windows Defender Application Control) to restrict executable execution to pre-approved applications, reducing the risk from tampered binaries.
- Enforce code signing policies across the organization: Require all software installations to pass signature verification through a controlled software deployment pipeline rather than allowing users to download and run executables directly.
- Monitor for tampered signed executables: Deploy endpoint detection capabilities that compare PE file hashes against known-good values and alert on signed executables whose content does not match the expected digest, which may indicate exploitation of CVE-2012-0151.
Technical Details
CVE-2012-0151 is a vulnerability in the Windows WinVerifyTrust function, which is responsible for validating Authenticode digital signatures on portable executable (PE) files. The flaw occurs because WinVerifyTrust does not properly verify the cryptographic digest of the PE file's content against the digest stored in the signature. This means an attacker can modify specific portions of a signed PE file — such as appending or modifying code sections — while the Authenticode signature continues to validate as authentic. The vulnerability is classified under CWE-20, as the root cause is improper validation of the file digest input during the signature verification process. The attack is user-assisted, requiring the victim to execute the tampered file, but since the file passes Windows signature checks, standard security warnings are suppressed, significantly increasing the likelihood of successful social engineering.
Frequently Asked Questions
Is CVE-2012-0151 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2012-0151 to the Known Exploited Vulnerabilities catalog. This vulnerability was notably used by the Flame malware for code signing forgery. The EPSS score of 89.0% in the 99th percentile indicates near-certain exploitation.
What products are affected by CVE-2012-0151?
CVE-2012-0151 affects the Authenticode Signature Verification function (WinVerifyTrust) in Microsoft Windows. Multiple Windows versions are affected, as WinVerifyTrust is a core operating system component used for validating software signatures.
How do I fix CVE-2012-0151?
Apply the Microsoft security updates that correct the WinVerifyTrust validation flaw. Additionally, enable strict Authenticode verification settings as recommended in Microsoft Security Advisory 2718704, and implement application whitelisting to restrict executable execution.
How severe is CVE-2012-0151?
CVE-2012-0151 is a critically severe vulnerability with an EPSS score in the 99th percentile. It undermines the Windows Authenticode trust model, allowing tampered executables to appear legitimately signed. This makes it exceptionally dangerous for supply chain attacks and advanced threat scenarios.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.