This document describes Symantec product detections for the Microsoft vulnerabilities for which Microsoft releases patches in their monthly Security Advisories.

Note: Symantec posts this information shortly after it becomes available from Microsoft. Any missing information will be added to the document as it becomes available.

ID and Rating	CAN/CVE ID:  CVE-2012-0002 BID: 52353 Microsoft ID: MS12-020 MSKB: 2671387 Microsoft Rating: Critical
Vulnerability Type	Microsoft Remote Desktop Protocol CVE-2012-0002 Remote Code Execution Vulnerability Remote Code Execution Vulnerability
Vulnerability Affects	Windows XP SP3, Windows XP Professional x64 Edition SP2, Windows Server 2003 SP2, Windows Server 2003 x64 Edition SP2, Windows Server 2003 with SP2 for Itanium-based Systems, Windows Vista SP2, Windows Vista x64 Edition SP2, Windows Server 2008 for 32-bit Systems SP2, Windows Server 2008 for x64-based Systems SP2, Windows Server 2008 for Itanium-based Systems SP2, Windows 7 for 32-bit Systems, Windows 7 for 32-bit Systems SP1, Windows 7 for x64-based Systems, Windows 7 for x64-based Systems SP1, Windows Server 2008 R2 for x64-based Systems, Windows Server 2008 R2 for x64-based Systems SP1, Windows Server 2008 R2 for Itanium-based Systems, and Windows Server 2008 R2 for Itanium-based Systems SP1
Details	A remote code execution vulnerability affects the Remote Desktop Protocol (RDP) due to a memory issue. An attacker can exploit this issue by sending a series of specially crafted packets to an affected service. Successful exploits will result in the complete compromise of affected computers.
Intrusion Protection System (IPS) Response	Sig ID: 25610 Detected as "Microsoft RDP CVE-2012-0002 3"
Other Detections	AV: N/A Sygate IDS: N/A Symantec Critical System Protection IPS: N/A

ID and Rating	CAN/CVE ID: CVE-2012-0016 BID: 52375 Microsoft ID: MS12-016 MSKB: 2651018 Microsoft Rating: Important
Vulnerability Type	Microsoft Expression 'wintab32.dll' DLL Loading Arbitrary Code Execution Vulnerability Remote Code Execution Vulnerability
Vulnerability Affects	Microsoft Expression Design, SP1, 2, 3, and 4
Details	A remote code-execution vulnerability affects Expression Design due to the way it loads DLL files. An attacker can exploit this issue by tricking an unsuspecting victim into opening a file associated with the application from a remote WebDAV or SMB share. Successful exploits will result in the execution of arbitrary attacker-supplied data in the context of the currently logged-in user.
Intrusion Protection System (IPS) Response	Sig ID: N/A
Other Detections	AV: N/A Sygate IDS: N/A Symantec Critical System Protection IPS: SCSPBP1: Generic Windows Interactive Protection

ID and Rating	CAN/CVE ID: CVE-2012-0006 BID: 52374 Microsoft ID: MS12-017 MSKB: 2647170 Microsoft Rating: Important
Vulnerability Type	Microsoft Windows DNS Server (CVE-2012-0006) Remote Denial of Service Vulnerability Denial of Service Vulnerability
Vulnerability Affects	Windows Server 2003 SP2, Windows Server 2003 x64 Edition SP2, Windows Server 2003 with SP2 for Itanium-based Systems, Windows Server 2008 for 32-bit Systems SP2, Windows Server 2008 for x64-based Systems SP2, Windows Server 2008 R2 for x64-based Systems, and Windows Server 2008 R2 for x64-based Systems SP1
Details	A denial-of-service vulnerability affects DNS service due to how it looks up a resource record of a domain. An attacker can exploit this issue by sending a specially crafted DNS query to an affected server. Successful exploits will cause the affected server to stop responding, effectively denying service.
Intrusion Protection System (IPS) Response	Sig ID: N/A
Other Detections	AV: N/A Sygate IDS: N/A Symantec Critical System Protection IPS: N/A

ID and Rating	CAN/CVE ID: CVE-2012-0157 BID: 52317 Microsoft ID: MS12-018 MSKB: 2641653 Microsoft Rating: Important
Vulnerability Type	Microsoft Windows Kernel 'Win32k.sys' (CVE-2012-0157) Local Privilege Escalation Vulnerability Elevation of Privilege Vulnerability
Vulnerability Affects	Windows XP SP3, Windows XP Professional x64 Edition SP2, Windows Server 2003 SP2, Windows Server 2003 x64 Edition SP2, Windows Server 2003 with SP2 for Itanium-based Systems, Windows Vista SP2, Windows Vista x64 Edition SP2, Windows Server 2008 for 32-bit Systems SP2, Windows Server 2008 for x64-based Systems SP2, Windows Server 2008 for Itanium-based Systems SP2, Windows 7 for 32-bit Systems, Windows 7 for 32-bit Systems SP1, Windows 7 for x64-based Systems, Windows 7 for x64-based Systems SP1, Windows Server 2008 R2 for x64-based Systems, Windows Server 2008 R2 for x64-based Systems SP1, Windows Server 2008 R2 for Itanium-based Systems, and Windows Server 2008 R2 for Itanium-based Systems SP1
Details	A local privilege-escalation vulnerability affects the Windows kernel due to how it handles the PostMessage function. A local attacker can exploit this issue by running a specially crafted program. Successful exploits will result in the attacker-supplied code running with kernel-level privileges. This may facilitate a complete system compromise.
Intrusion Protection System (IPS) Response	Sig ID: N/A
Other Detections	AV: N/A Sygate IDS: N/A Symantec Critical System Protection IPS: N/A