==================================================================== CERT-Renater Note d'Information No. 2012/VULN175 ____________________________________________________________________ DATE : 11/04/2012 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S) : Systems running Microsoft Office versions 2003, 2007, 2010, Microsoft SQL Server versions 2000, 2005, 2008, Microsoft BizTalk Server version 2002, Microsoft Commerce Server versions 2002, 2007, 2009, Microsoft Visual FoxPro version 8, 9, Visual Basic Runtime version 6.0. ====================================================================== KB2664258 http://technet.microsoft.com/en-us/security/bulletin/ms12-027 ______________________________________________________________________ Microsoft Security Bulletin MS12-027 - Critical Vulnerability in Windows Common Controls Could Allow Remote Code Execution (2664258) Published Date: April 10, 2012 Version: 1.0 General Information Executive Summary This security update resolves a privately disclosed vulnerability in Windows common controls. The vulnerability could allow remote code execution if a user visits a website containing specially crafted content designed to exploit the vulnerability. In all cases, however, an attacker would have no way to force users to visit such a website. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes them to the attacker's website. The malicious file could be sent as an email attachment as well, but the attacker would have to convince the user to open the attachment in order to exploit the vulnerability. This security update is rated Critical for all supported Microsoft software that included the Windows common controls in their default installations. This includes all supported editions of Microsoft Office 2003, Microsoft Office 2007; Microsoft Office 2010 (except x64-based editions); Microsoft SQL Server 2000 Analysis Services, Microsoft SQL Server 2000 (except Itanium-based editions), Microsoft SQL Server 2005 (except Microsoft SQL Server 2005 Express Edition, but including Microsoft SQL Server 2005 Express Edition with Advanced Services), Microsoft SQL Server 2008, Microsoft SQL Server 2008 R2, Microsoft BizTalk Server 2002, Microsoft Commerce Server 2002, Microsoft Commerce Server 2007, Microsoft Commerce Server 2009, Microsoft Commerce Server 2009 R2, Microsoft Visual FoxPro 8.0, Microsoft Visual FoxPro 9.0, and Visual Basic 6.0 Runtime. Affected Software Microsoft Office 2003 Service Pack 3 Microsoft Office 2003 Web Components Service Pack 3 Microsoft Office 2007 Service Pack 2 Microsoft Office 2007 Service Pack 3 Microsoft Office 2010 (32-bit editions) Microsoft Office 2010 Service Pack 1 (32-bit editions) Microsoft SQL Server 2000 Analysis Services Service Pack 4 Microsoft SQL Server 2000 Service Pack 4(KB983808) Microsoft SQL Server 2005 Express Edition with Advanced Services Service Pack 4 Microsoft SQL Server 2005 for 32-bit Systems Service Pack Microsoft SQL Server 2005 for Itanium-based Systems Service Pack Microsoft SQL Server 2005 for x64-based Systems Service Pack Microsoft SQL Server 2008 Microsoft SQL Server 2008 for 32-bit Systems Service Pack 2 Microsoft SQL Server 2008 for 32-bit Systems Service Pack 3 Microsoft SQL Server 2008 for x64-based Systems Service Pack 2 Microsoft SQL Server 2008 for x64-based Systems Service Pack 3 Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 2 Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 3 Microsoft SQL Server 2008 R2 for 32-bit Systems Microsoft SQL Server 2008 R2 for x64-based Systems Microsoft SQL Server 2008 R2 for Itanium-based Systems Microsoft BizTalk Server 2002 Service Pack 1 Microsoft Commerce Server Microsoft Commerce Server 2002 Service Pack 4 Microsoft Commerce Server 2007 Service Pack 2 Microsoft Commerce Server 2009 Microsoft Commerce Server 2009 R2 Microsoft Visual FoxPro 8.0 Service Pack 1 Microsoft Visual FoxPro 9.0 Service Pack 2 Visual Basic Visual Basic 6.0 Runtime Vulnerability Information MSCOMCTL.OCX RCE Vulnerability - CVE-2012-0158 A remote code execution vulnerability exists in the Windows common controls. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. ====================================================================== ========================================================= Serveur de référence du CERT-Renater https://services.renater.fr/ssi/ ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23 - 25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================