RCE in Microsoft Biztalk Server
CVE-2012-0158
The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 1.000 (100.0th percentile), scored .
Very high probability of exploitation in the next 30 days — among the top 0.1% most-likely-to-be-exploited CVEs. 100th percentile — 100.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
- Microsoft Biztalk Server — versions 2002
- Microsoft Commerce Server — versions 2002, 2007
- Microsoft Commerce Server 2009 — versions r2
- Microsoft Office — versions 2003, 2007, 2010
- Microsoft Office Web Components — versions 2003
- Microsoft SQL Server 2000
- Microsoft SQL Server 2005
- Microsoft SQL Server 2008 — versions r2
- Microsoft Visual Basic — versions 6.0
- Microsoft Visual Foxpro — versions 8.0, 9.0
Weakness classification (CWE)
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply updates per vendor instructions.
Known ransomware campaign use: yes.
Public proof-of-concept exploits
References
- www.securitytracker.com/id (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
- www.securitytracker.com/id (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
- www.us-cert.gov/cas/techalerts/TA12-101A.html (US Government Resource, Third Party Advisory, third-party-advisory)
- www.securitytracker.com/id (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
- www.securitytracker.com/id (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
- www.securitytracker.com/id (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
- opensources.info/comment-on-the-curious-case-of-a-cve-2012-0158-exploit-by-chri… (Broken Link)
- docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-027 (vendor-advisory, Patch, Vendor Advisory)
- oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:15462 (Broken Link, signature, vdb-entry)
- www.securityfocus.com/bid/52911 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
Frequently asked questions
- What is CVE-2012-0158?
- CVE-2012-0158 is a high-severity vulnerability in Microsoft Biztalk Server, classified under Code Injection. CVSS score: 8.8/10. Published 2012-04-10.
- How severe is CVE-2012-0158?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2012-0158 known to be exploited?
- Yes. CVE-2012-0158 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating it is being actively exploited. 31 public proof-of-concept repositories are indexed.