8.8Yüksek KEV Fidye yazılımında kullanılıyor

CVE-2012-0158Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability

microsoft office; microsoft office web components; microsoft sql server 2000; microsoft sql server 2005 Yayım: 2012-04-11 00:00 (14 yıl önce)

Aktif olarak istismar ediliyor — Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 03.11.2021 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 03.05.2022.

Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2012-0158

Açıklama

The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."

Zayıflık türü (CWE): CWE-94

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
microsoft	biztalk server	2002
microsoft	commerce server	2002
microsoft	commerce server 2009	r2
microsoft	office	2003
microsoft	office web components	2003
microsoft	sql server 2000	—
microsoft	sql server 2005	—
microsoft	sql server 2008	r2
microsoft	visual basic	6.0
microsoft	visual foxpro	8.0

Kaynaklar ve yamalar

1026902 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
1026899 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
TA12-101A third-party-advisoryThird Party AdvisoryUS Government Resource
1026904 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
1026903 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
1026905 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
http://opensources.info/comment-on-the-curious-case-of-a-cve-2012-0158-exploit-by-chris-pierce/ Broken Link
MS12-027 vendor-advisoryPatchVendor Advisory
oval:org.mitre.oval:def:15462 vdb-entrysignatureBroken Link
52911 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
ms-activex-control-code-execution(74372) vdb-entryThird Party AdvisoryVDB Entry
1026900 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0158 US Government Resource

CPE eşleşmeleri (NVD) (20)

cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2010:-:*:*:*:*:x86:*
cpe:2.3:a:microsoft:office:2010:sp1:*:*:*:*:x86:*
cpe:2.3:a:microsoft:office_web_components:2003:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server_2000:-:sp4:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server_2005:-:sp4:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server_2008:-:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server_2008:-:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server_2008:r2:-:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server_2008:r2:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:biztalk_server:2002:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:commerce_server:2002:sp4:*:*:*:*:*:*
cpe:2.3:a:microsoft:commerce_server:2007:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:commerce_server_2009:-:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:commerce_server_2009:r2:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_basic:6.0:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:*

CVSS puanı

8.8Yüksek

Kaynak: CISA-ADP · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekir
Kapsam: Değişmez
Gizlilik: Yüksek
Bütünlük: Yüksek
Erişilebilirlik: Yüksek

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tüm puanlar (4)

CISA-ADP	CVSS 3.1	8.8Yüksek
nvd	CVSS 3.1	8.8Yüksek
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	8.8Yüksek
nvd	CVSS 2.0	9.3Yüksek

EPSS (30 günde istismar olasılığı)

99.98%

tüm CVE'lerin %100'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: active
Otomatikleştirilebilir: no
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2011-12-13
Yayımlandı2012-04-11 00:00
IP-DB'ye ulaştı2026-10-24 23:35
KEV'e eklendi2021-11-03
Son güncelleme2026-06-17 02:36

Numarayı veren (CNA): microsoft
NVD durumu: Analyzed

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — Microsoft SQL Server

8.8Yüksek

CVE-2026-118120 3 gün önce

Microsoft SQL Server Elevation of Privilege Vulnerability

Microsoft Microsoft SQL Server 2017 (GDR); Microsoft Microsoft SQL Server 2017 for x64-based Systems (CU31); Microsoft Microsoft SQL Server 2019 (GDR); Microsoft Microsoft SQL Server 2019 for x64-based Systems (CU32)

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

1.1%EPSS

8.0Yüksek

CVE-2026-118118 3 gün önce

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

8.0Yüksek

CVE-2026-118119 3 gün önce

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

7.0Yüksek

CVE-2026-118116 3 gün önce

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.

1.9%EPSS

8.0Yüksek

CVE-2026-118117 3 gün önce

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

7.5Yüksek

CVE-2026-118114 3 gün önce

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.