CVE-2012-0158 · threatengine.sh

Home/CVE/Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability

CVE

CVE-2012-0158

Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability

The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1.

Office 2003 Web Components SP3.

SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2.

BizTalk Server 2002 SP1.

Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2.

Visual FoxPro 8.0 SP1 and 9.0 SP2.

and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability.".

HIGH · CVSS 8.8 ⚠ CISA KEV EPSS 0.94289

Act now

Listed on CISA KEV (known exploited in the wild)
SSVC exploitation status: active
EPSS ≥ 0.50 - high probability of exploitation in the next 30 days
EPSS percentile: top 0% of all CVEs by exploitation likelihood
Public exploit or PoC is available
CVSS base score ≥ 7.0

Sigma rules9 YARA rules1

⬢

Required Remediation

Apply updates per vendor instructions.

◆

Threat Actors Linked

16

actorAoqin Dragon
actorAPT1
actorAPT41
actorCarbanak
actorCloud Atlas
actorDarkhotel
Show all 16 actorsactorGoblin Panda
actorIcefog
actorKe3chang
actorTransparent Tribe
actorNaikon
actorNetTraveler / Travnet
actorPatchwork
actorRedFoxtrot
actorTonto Team
actorTropic Trooper

⬡

Weakness Classification

CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94Improper Control of Generation of Code ('Code Injection')

▤

Affected Products & Versions

10

microsoft officeall versions
microsoft office web componentsall versions
microsoft sql server 2000all versions
microsoft sql server 2005all versions
microsoft sql server 2008all versions
microsoft biztalk serverall versions
microsoft commerce serverall versions
microsoft commerce server 2009all versions
Show all 10 affected productsmicrosoft visual basicall versions
microsoft visual foxproall versions

⚠

Public Exploits & PoCs

1

remoteMicrosoft Windows - MSCOMCTL ActiveX Buffer Overflow (MS12-027) (Metasploit)verified

◈

Sigma Hunt Rules

9

Exact rules name this CVE ID. Product rules name an affected product in their title. Related rules cover techniques used by actors who exploited this CVE. Showing the most relevant matches; the complete related set is on the full drill-down.

producthighVisual Basic Command Line Compiler Usage

producthighSuspicious Microsoft Office Child Process - MacOS

producthighCode Executed Via Office Add-in XLL File

producthighPotential Persistence Via Microsoft Office Add-In

producthighPotential Persistence Via Microsoft Office Startup Folder

producthighFile With Uncommon Extension Created By An Office Application

Show all 9 top matches

producthighOffice Macro File Creation From Suspicious Process

producthighUncommon File Created In Office Startup Folder

producthighPotentially Suspicious Office Document Executed From Trusted Location

See all related Sigma rules for this CVE

▣

Scoring & Timeline

8.8

HIGH · CVSS v3.1 · secure@microsoft.com

View on NVD

Attack Vector

Network Adjacent Local Physical

Attack Complexity

Low High

Privileges Required

None Low High

User Interaction

None Required

Scope

Unchanged Changed

Confidentiality

None Low High

Integrity

None Low High

Availability

None Low High

Published to NVD10 Apr 2012 · 09:55 PM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC triage · cisa-vulnrichment

Exploitation

active

Automatable

no

Technical impact

total

SSVC asks the questions that actually drive patch urgency: is it being exploited, can attacks be automated, and how total is the impact.

⚑

Vendor Advisories

1

cisaKEV-CVE-2012-0158

🔗

References & Sources

13

Source URLs (vendor pages, mailing lists, write-ups). Exploit/PoC links are in their own section above to avoid duplication.

http://opensources.info/comment-on-the-curious-case-of-a-cve-2012-0158-exploit-by-chris-pierce/Broken Link

http://www.securityfocus.com/bid/52911Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1026899Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1026900Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1026902Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1026903Broken LinkThird Party AdvisoryVDB Entry

Show all 13 references

http://www.securitytracker.com/id?1026904Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1026905Broken LinkThird Party AdvisoryVDB Entry

http://www.us-cert.gov/cas/techalerts/TA12-101A.htmlThird Party AdvisoryUS Government Resource

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-027PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/74372Third Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15462Broken Link

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0158US Government Resource

Intelligence Graph · click any node to traverse

CVETechnique ActorTool Family

drag to reposition · click any node to traverse · button top-right enlarges

External lookups - second-class, for what we don’t hold ourselves

NVD CVE.org CISA Vulners Exploit-DB GitHub PoC VulnCheck KEV GreyNoise

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin