CVE-2013-1285
The USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 do not properly handle objects in memory,…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.46%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 do not properly handle objects in memory, which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device, aka "Windows USB Descriptor Vulnerability," a different vulnerability than CVE-2013-1286 and CVE-2013-1287.
- CVSS 2.0
- 7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 1.46% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- microsoft/windows xp · microsoft/windows server 2003 · microsoft/windows vista · microsoft/windows server 2008 · microsoft/windows 7 · microsoft/windows 8 · microsoft/windows server 2012
- Source
- secure@microsoft.com
References
- http://www.us-cert.gov/ncas/alerts/TA13-071AUS Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-027
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16441
- http://www.us-cert.gov/ncas/alerts/TA13-071AUS Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-027
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16441
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.