CVE-2012-0158: microsoft office +9 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2012-0158

CVSS 8.8 · High KEV · sudah dieksploitasi Dipakai ransomware EPSS 100,0%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada microsoft office, microsoft office web components +8 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."

Rincian

Terbit di NVD: 10 April 2012
Terakhir diubah: 16 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-94: Improper Control of Generation of Code ('Code Injection')
EPSS (30 hari): 100,0% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
Masuk KEV: 3 November 2021
Tenggat CISA: 3 Mei 2022 (untuk instansi federal AS)
Ransomware: Tercatat dipakai dalam kampanye ransomware
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
microsoft	office	Versi 2003 sp3
microsoft	office	Versi 2007 sp2
microsoft	office	Versi 2007 sp3
microsoft	office	Versi 2010
microsoft	office	Versi 2010 sp1
microsoft	office web components	Versi 2003 sp3
microsoft	sql server 2000	Semua versi
microsoft	sql server 2005	Semua versi
microsoft	sql server 2008	Semua versi
microsoft	sql server 2008	Versi r2
microsoft	sql server 2008	Versi r2 sp1
microsoft	biztalk server	Versi 2002 sp1
microsoft	commerce server	Versi 2002 sp4
microsoft	commerce server	Versi 2007 sp2
microsoft	commerce server 2009	Semua versi
microsoft	commerce server 2009	Versi r2
microsoft	visual basic	Versi 6.0
microsoft	visual foxpro	Versi 8.0 sp1
microsoft	visual foxpro	Versi 9.0 sp2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-027 patch · advisory vendor
http://www.us-cert.gov/cas/techalerts/TA12-101A.html advisory pihak ketiga · pemerintah AS
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0158 pemerintah AS
http://www.securityfocus.com/bid/52911 broken link · advisory pihak ketiga · vdb entry
http://www.securitytracker.com/id?1026899 broken link · advisory pihak ketiga · vdb entry
http://www.securitytracker.com/id?1026900 broken link · advisory pihak ketiga · vdb entry
http://www.securitytracker.com/id?1026902 broken link · advisory pihak ketiga · vdb entry
http://www.securitytracker.com/id?1026903 broken link · advisory pihak ketiga · vdb entry
http://www.securitytracker.com/id?1026904 broken link · advisory pihak ketiga · vdb entry
http://www.securitytracker.com/id?1026905 broken link · advisory pihak ketiga · vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/74372 advisory pihak ketiga · vdb entry
http://opensources.info/comment-on-the-curious-case-of-a-cve-2012-0158-exploit-by-chris-pierce/ broken link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15462 broken link

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.