Signature Detail

HTTP: Microsoft Common Controls MSCOMCTL.OCX Activex Remote Code Execution

This signature detects attempts to use unsafe ActiveX controls in Microsoft MSCOMCTL.OCX. An attacker can create a malicious Web site containing Web pages with dangerous ActiveX controls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

Microsoft Windows Common Controls is prone to a remote code-execution vulnerability. An attacker can exploit this issue by enticing an unsuspecting user to view a malicious webpage. Successful exploits will allow the attacker to execute arbitrary code within the context of the application (typically Internet Explorer) that uses the ActiveX control.

Affected Products

• Microsoft biztalk_server_2002 SP1
• Microsoft commerce_server_2002 SP4
• Microsoft commerce_server_2007 SP2
• Microsoft commerce_server_2009 R2
• Microsoft commerce_server_2009
• Microsoft host_integration_server_2004 SP1
• Microsoft office_2003 SP3
• Microsoft office_2003_web_components SP3
• Microsoft office_2007 SP2
• Microsoft office_2007 SP3
• Microsoft office_2010 (32-bit edition) SP1
• Microsoft sql_server_2000 SP4
• Microsoft sql_server_2000_analysis_services_sp4
• Microsoft sql_server_2005 SP4
• Microsoft sql_server_2005_express_edition_with_advanced_serv SP1
• Microsoft sql_server_2005_express_edition_with_advanced_serv SP2
• Microsoft sql_server_2005_express_edition_with_advanced_serv SP3
• Microsoft sql_server_2005_express_edition_with_advanced_serv SP4
• Microsoft sql_server_2005_itanium_edition SP4
• Microsoft sql_server_2005_x64_edition SP4
• Microsoft sql_server_2008 R2
• Microsoft sql_server_2008 R2 SP1
• Microsoft sql_server_2008_32-bit R2
• Microsoft sql_server_2008_32-bit SP2
• Microsoft sql_server_2008_32-bit SP3
• Microsoft sql_server_2008_itanium R2
• Microsoft sql_server_2008_itanium SP2
• Microsoft sql_server_2008_itanium SP3
• Microsoft sql_server_2008_x64 R2
• Microsoft sql_server_2008_x64 SP2
• Microsoft sql_server_2008_x64 SP3
• Microsoft visual_basic_6.0_runtime
• Microsoft visual_foxpro 8.0 SP1
• Microsoft visual_foxpro 9.0 SP2

References

• BugTraq: 54948
• CVE: CVE-2012-1856