Where to Buy Trend Micro Products

For Home

For Small Business

1-888-762-8736
(M-F 8:00am-5:00pm CST)

For Enterprise

1-877-218-7353
(M-F 8:00am-5:00pm CST)

Not in the United States?
Select the country/language of your choice:

Asia Pacific Region

Europe

The Americas

Not in the United States?
Select the country/language of your choice:

Asia/Pacific

Europe

America

Login

For Home

For Business

For Partners

Threat Encyclopedia

MSCOMCTL.OCX RCE Vulnerability (CVE-2012-0158)

CVE-2012-0158

SEVERITY

CRITICAL

//  ADVISORY DATE

  


DESCRIPTION

The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."

TREND MICRO PROTECTION INFORMATION

Trend Micro Deep Security shields networks through Deep Packet Inspection (DPI) rules. Trend Micro customers using OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities. Please refer to the filter number and filter name when applying appropriate DPI and/or IDF rules.

SOLUTION

FILTER IDENTIFIER NUMBER: 1004978

FILTER IDENTIFIER TITLE: 1004978 - MSCOMCTL.OCX RCE Vulnerability For Office Binary File (CVE-2012-0158)

AFFECTED SOFTWARE AND VERSION

  • microsoft biztalk_server 2002
  • microsoft commerce_server 2002
  • microsoft commerce_server 2007
  • microsoft commerce_server 2009
  • microsoft office 2003
  • microsoft office 2007
  • microsoft office 2010
  • microsoft office_web_components 2003
  • microsoft sql_server 2000
  • microsoft sql_server 2005
  • microsoft sql_server 2008
  • microsoft visual_basic 6.0
  • microsoft visual_foxpro 8.0
  • microsoft visual_foxpro 9.0

Connect with us on