⚠ Actively exploited
Added to CISA KEV on 2022-03-03. Federal agencies required to patch by 2022-03-24. Required action: Apply updates per vendor instructions..

CVE-2012-1856

CWE-94 — Code Injection8 documents6 sources
Severity
8.8HIGH
EPSS
91.6%
top 0.33%
CISA KEV
KEV
Added 2022-03-03
Due 2022-03-24
Exploit
Exploited in wild
Active exploitation observed
Affected products
7
Microsoft Commerce ServerMicrosoft Host Integration ServerMicrosoft Office+4 more
Timeline
PublishedAug 15
KEV addedMar 3
KEV dueMar 24
Latest updateMay 14
CISA Required Action: Apply updates per vendor instructions.

Description

The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Server 2005 SP4, SQL Server 2008 SP2, SP3, R2, R2 SP1, and R2 SP2, Commerce Server 2002 SP4, Commerce Server 2007 SP2, Commerce Server 2009 Gold and R2, Host Integration Server 2004 SP1, Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP2, and Visual Basic 6.0 Runtime allows remote attackers to execute arbitr…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages7 packages

▶NVDmicrosoft/commerce_server2002, 2007, 2009+2
▶NVDmicrosoft/sql_server2000, 2005, 2008+2
▶NVDmicrosoft/visual_foxpro8.0, 9.0+1

Patches

Patch: docs.microsoft.com ↗Patch: docs.microsoft.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-q2jx-rgv9-xm3x: The TabStrip ActiveX control in the Common Controls in MSCOMCTL↗2022-05-14
▶
CVEList
CVE-2012-1856: The TabStrip ActiveX control in the Common Controls in MSCOMCTL↗2012-08-15
▶
VulnCheck
Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability↗2012
▶

📋Vendor Advisories

1
CISA
Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability↗2022-03-03
▶

🕵️Threat Intelligence

2
Unit42
Inception Attackers Target Europe with Year-old Office Vulnerability↗2018-11-05
▶
Unit42
RTF Exploit Installs Italian RAT: uWarrior↗2015-08-24
▶
CVE-2012-1856 (HIGH CVSS 8.8) | The TabStrip ActiveX control in the | cvebase.io