RCE in Microsoft Biztalk Server
CVE-2012-0158
The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."
Vulnerability class: RCE (Remote Code Execution)
EPSS: 1.000 (100.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Microsoft Biztalk_server — versions 2002
- Microsoft Commerce_server — versions 2002, 2007
- Microsoft Commerce_server_2009 — versions r2
- Microsoft Office — versions 2003, 2007, 2010
- Microsoft Office_web_components — versions 2003
- Microsoft Sql_server_2000
- Microsoft Sql_server_2005
- Microsoft Sql_server_2008 — versions r2
- Microsoft Visual_basic — versions 6.0
- Microsoft Visual_foxpro — versions 8.0, 9.0
Weakness classification (CWE)
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply updates per vendor instructions.
Known ransomware campaign use: yes.
Public proof-of-concept exploits
References
- secure@microsoft.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK, Broken Link)
- secure@microsoft.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK, Broken Link)
- secure@microsoft.com (US Government Resource, Third Party Advisory, x_refsource_CERT, third-party-advisory)
- secure@microsoft.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK, Broken Link)
- secure@microsoft.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK, Broken Link)
- secure@microsoft.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK, Broken Link)
- secure@microsoft.com (x_refsource_MISC, Broken Link)
- secure@microsoft.com (x_refsource_MS, vendor-advisory, Patch, Vendor Advisory)
- secure@microsoft.com (Broken Link, signature, x_refsource_OVAL, vdb-entry)
- secure@microsoft.com (VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
Frequently asked questions
- What is CVE-2012-0158?
- CVE-2012-0158 is a high-severity vulnerability in Microsoft Biztalk Server, classified under Code Injection. CVSS score: 8.8/10. Published 2012-04-10.
- How severe is CVE-2012-0158?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2012-0158 known to be exploited?
- Yes. CVE-2012-0158 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating it is being actively exploited. 31 public proof-of-concept repositories are indexed.