CVE-2012-1856 - The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Of

CVE-2012-1856

Summary

The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Server 2005 SP4, SQL Server 2008 SP2, SP3, R2, R2 SP1, and R2 SP2, Commerce Server 2002 SP4, Commerce Server 2007 SP2, Commerce Server 2009 Gold and R2, Host Integration Server 2004 SP1, Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP2, and Visual Basic 6.0 Runtime allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption, aka "MSCOMCTL.OCX RCE Vulnerability."

References

Vulnerable Configurations

cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:commerce_server:2007:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:commerce_server:2007:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:commerce_server:2009:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:commerce_server:2009:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2010:sp1:x86:*:*:*:*:*
cpe:2.3:a:microsoft:office:2010:sp1:x86:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2008:r2_sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2008:r2_sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2008:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2008:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:commerce_server:2002:sp4:*:*:*:*:*:*
cpe:2.3:a:microsoft:commerce_server:2002:sp4:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2005:sp4:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2005:sp4:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2000:sp4:analysis_services:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2000:sp4:analysis_services:*:*:*:*:*
cpe:2.3:a:microsoft:host_integration_server:2004:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:host_integration_server:2004:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:commerce_server:2009:r2:*:*:*:*:*:*
cpe:2.3:a:microsoft:commerce_server:2009:r2:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2005:sp3:express_advanced_services:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2005:sp3:express_advanced_services:*:*:*:*:*
cpe:2.3:a:microsoft:visual_basic:6.0:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_basic:6.0:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_web_components:2003:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_web_components:2003:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2000:sp4:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2000:sp4:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2008:r2_sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2008:r2_sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2008:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2008:sp2:*:*:*:*:*:*

CVSS

Base:	9.3 (as of 16-07-2024 - 17:37)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:M/Au:N/C:C/I:C/A:C

msbulletin via4

bulletin_id	MS12-060
bulletin_url
date	2012-08-14T00:00:00
impact	Remote Code Execution
knowledgebase_id	2720573
knowledgebase_url
severity	Critical
title	Vulnerability in Windows Common Controls Could Allow Remote Code Execution

oval via4

accepted

2014-06-09T04:00:13.929-04:00

class

vulnerability

contributors

name SecPod Team
organization SecPod Technologies
name Chandan S
organization SecPod Technologies
name Pradeep R B
organization SecPod Technologies
name Pradeep R B
organization SecPod Technologies
name Dragos Prisaca
organization G2, Inc.

definition_extensions

comment Microsoft Office 2003 SP3 is installed
oval oval:org.mitre.oval:def:15626
comment Microsoft Office 2003 Web Components SP3 is installed
oval oval:org.mitre.oval:def:15325
comment Microsoft Office 2010 SP1 is installed
oval oval:org.mitre.oval:def:15198
comment Microsoft Office 2007 SP2 is installed
oval oval:org.mitre.oval:def:15607
comment Microsoft Office 2007 SP3 is installed
oval oval:org.mitre.oval:def:15704
comment Microsoft SQL Server 2008 SP3 is installed
oval oval:org.mitre.oval:def:15497
comment Microsoft SQL Server 2008 R2 SP1 is installed
oval oval:org.mitre.oval:def:15808
comment Microsoft SQL Server 2008 R2 is installed
oval oval:org.mitre.oval:def:12596
comment Microsoft SQL Server 2008 SP2 is installed
oval oval:org.mitre.oval:def:12310
comment Microsoft SQL Server 2008 R2 SP2 is installed
oval oval:org.mitre.oval:def:15803
comment Microsoft SQL Server 2005 SP4 is installed
oval oval:org.mitre.oval:def:12442
comment Microsoft Commerce Server 2002 SP4 is installed
oval oval:org.mitre.oval:def:15722
comment Microsoft Commerce Server 2007 SP2 is installed
oval oval:org.mitre.oval:def:15552
comment Microsoft Commerce Server 2009 is installed
oval oval:org.mitre.oval:def:15443
comment Microsoft Commerce Server 2009 R2 is installed
oval oval:org.mitre.oval:def:15274
comment Microsoft Visual FoxPro is installed
oval oval:org.mitre.oval:def:14198
comment Microsoft Visual FoxPro is installed
oval oval:org.mitre.oval:def:14198
comment Microsoft Host Integration Server 2004 SP1 is installed
oval oval:org.mitre.oval:def:5430
comment Microsoft Visual Basic 6.0 is installed
oval oval:org.mitre.oval:def:15369
comment Microsoft SQL Server 2000 Analysis Services SP4 is installed
oval oval:org.mitre.oval:def:15730
comment Microsoft SQL Server 2000 SP4 is installed
oval oval:org.mitre.oval:def:15762

description

family

windows

oval:org.mitre.oval:def:15447

status

accepted

submitted

2012-08-21T11:30:57

title

MSCOMCTL.OCX RCE Vulnerability - MS12-060

version

refmap via4

bid	54948
cert	TA12-227A

Last major update

16-07-2024 - 17:37

Published

15-08-2012 - 01:55

Last modified

16-07-2024 - 17:37