CVE-2012-1856: microsoft commerce server +6 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2012-1856

CVSS 8.8 · High KEV · sudah dieksploitasi EPSS 72,0%

Kerentanan pada microsoft commerce server, microsoft host integration server +5 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD. Masuk katalog KEV CISA pada 3 Maret 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Server 2005 SP4, SQL Server 2008 SP2, SP3, R2, R2 SP1, and R2 SP2, Commerce Server 2002 SP4, Commerce Server 2007 SP2, Commerce Server 2009 Gold and R2, Host Integration Server 2004 SP1, Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP2, and Visual Basic 6.0 Runtime allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption, aka "MSCOMCTL.OCX RCE Vulnerability."

Rincian

Terbit di NVD: 15 Agustus 2012
Terakhir diubah: 16 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
EPSS (30 hari): 72,0% peluang dieksploitasi; lebih tinggi dari 99,4% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability
Masuk KEV: 3 Maret 2022
Tenggat CISA: 24 Maret 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
microsoft	commerce server	Versi 2002 sp4
microsoft	commerce server	Versi 2007 sp2
microsoft	commerce server	Versi 2009
microsoft	commerce server	Versi 2009 r2
microsoft	host integration server	Versi 2004 sp1
microsoft	office	Versi 2003 sp3
microsoft	office	Versi 2007 sp2
microsoft	office	Versi 2007 sp3
microsoft	office	Versi 2010 sp1
microsoft	office web components	Versi 2003 sp3
microsoft	sql server	Versi 2000 sp4
microsoft	sql server	Versi 2005 sp3
microsoft	sql server	Versi 2005 sp4
microsoft	sql server	Versi 2008 r2_sp1
microsoft	sql server	Versi 2008 r2_sp2
microsoft	sql server	Versi 2008 sp2
microsoft	sql server	Versi 2008 sp3
microsoft	visual basic	Versi 6.0
microsoft	visual foxpro	Versi 8.0 sp1
microsoft	visual foxpro	Versi 9.0 sp2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-060 patch · advisory vendor
http://www.us-cert.gov/cas/techalerts/TA12-227A.html advisory pihak ketiga · pemerintah AS
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1856 pemerintah AS
http://www.securityfocus.com/bid/54948 broken link · advisory pihak ketiga · vdb entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15447 broken link

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.