FKIE_CVE-2012-2515

Vulnerability from fkie_nvd - Published: 2012-07-05 03:23 - Updated: 2026-06-16 23:41
Severity
Summary
Multiple stack-based buffer overflows in the KeyHelp.KeyCtrl.1 ActiveX control in KeyHelp.ocx 1.2.312 in KeyWorks KeyHelp Module (aka the HTML Help component), as used in EMC Documentum ApplicationXtender Desktop 5.4; EMC Captiva Quickscan Pro 4.6 SP1; GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; GE Intelligent Platforms Proficy HMI/SCADA iFIX 5.0 and 5.1; GE Intelligent Platforms Proficy Pulse 1.0; GE Intelligent Platforms Proficy Batch Execution 5.6; GE Intelligent Platforms SI7 I/O Driver 7.20 through 7.42; and other products, allow remote attackers to execute arbitrary code via a long string in the second argument to the (1) JumpMappedID or (2) JumpURL method.
References
ics-cert@hq.dhs.govhttp://retrogod.altervista.org/9sg_emc_keyhelp.htmlExploit
ics-cert@hq.dhs.govhttp://secunia.com/advisories/36905Vendor Advisory
ics-cert@hq.dhs.govhttp://secunia.com/advisories/36914Vendor Advisory
ics-cert@hq.dhs.govhttp://support.ge-ip.com/support/resources/sites/GE_FANUC_SUPPORT/content/live/KB/14000/KB14863/en_US/GEIP12-04%20Security%20Advisory%20-%20Proficy%20HTML%20Help.pdfVendor Advisory
ics-cert@hq.dhs.govhttp://www.securityfocus.com/bid/36546Exploit
ics-cert@hq.dhs.govhttp://www.us-cert.gov/control_systems/pdf/ICSA-12-131-02.pdfUS Government Resource
ics-cert@hq.dhs.govhttp://www.vupen.com/english/advisories/2009/2793
ics-cert@hq.dhs.govhttp://www.vupen.com/english/advisories/2009/2795
af854a3a-2127-422b-91ae-364da2661108http://retrogod.altervista.org/9sg_emc_keyhelp.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36905Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36914Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://support.ge-ip.com/support/resources/sites/GE_FANUC_SUPPORT/content/live/KB/14000/KB14863/en_US/GEIP12-04%20Security%20Advisory%20-%20Proficy%20HTML%20Help.pdfVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/36546Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.us-cert.gov/control_systems/pdf/ICSA-12-131-02.pdfUS Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/2793
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/2795
Impacted products
Vendor Product Version
emc captiva_quickscan_pro 4.6
emc documentum_applicationxtender_desktop 5.4
ge intelligent_platforms_proficy_batch_execution 5.6
ge intelligent_platforms_proficy_historian 3.1
ge intelligent_platforms_proficy_historian 3.5
ge intelligent_platforms_proficy_historian 4.0
ge intelligent_platforms_proficy_historian 4.5
ge intelligent_platforms_proficy_hmi\/scada_ifix 5.0
ge intelligent_platforms_proficy_hmi\/scada_ifix 5.1
ge intelligent_platforms_proficy_pulse 1.0
ge intelligent_platforms_si7_i\/o_driver 7.20
ge intelligent_platforms_si7_i\/o_driver 7.42
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "ics-cert@hq.dhs.gov"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:emc:captiva_quickscan_pro:4.6:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "8B464AC4-7766-47DB-AE36-1E26D244EC67",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:emc:documentum_applicationxtender_desktop:5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "A361D413-79A2-492B-A675-7A40023BC0D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ge:intelligent_platforms_proficy_batch_execution:5.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D91A768-D643-4601-B11D-2C5FB60B8566",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ge:intelligent_platforms_proficy_historian:3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "612B7F05-3C6D-43CA-8D6C-F0A887789EF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ge:intelligent_platforms_proficy_historian:3.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "6D29C00B-B754-47C5-BBD0-D63DDD252DA6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ge:intelligent_platforms_proficy_historian:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6BC9F852-EA9A-497D-9ED2-DAF926D0440A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ge:intelligent_platforms_proficy_historian:4.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "2C8C84F4-699E-4D77-AF36-19DF28AE16CC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\\/scada_ifix:5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "65A4CBC3-3B98-4700-8710-4D4FFCA55315",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\\/scada_ifix:5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5ABA340B-B00B-41EC-8270-68139B63D09A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ge:intelligent_platforms_proficy_pulse:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "738ACF30-4F1A-44C6-9A97-46F5566ACC05",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ge:intelligent_platforms_si7_i\\/o_driver:7.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "641F3A0F-9E07-413D-869C-8E123636DD0A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ge:intelligent_platforms_si7_i\\/o_driver:7.42:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA786450-C420-420A-9C5E-49D408B6B3C2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple stack-based buffer overflows in the KeyHelp.KeyCtrl.1 ActiveX control in KeyHelp.ocx 1.2.312 in KeyWorks KeyHelp Module (aka the HTML Help component), as used in EMC Documentum ApplicationXtender Desktop 5.4; EMC Captiva Quickscan Pro 4.6 SP1; GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; GE Intelligent Platforms Proficy HMI/SCADA iFIX 5.0 and 5.1; GE Intelligent Platforms Proficy Pulse 1.0; GE Intelligent Platforms Proficy Batch Execution 5.6; GE Intelligent Platforms SI7 I/O Driver 7.20 through 7.42; and other products, allow remote attackers to execute arbitrary code via a long string in the second argument to the (1) JumpMappedID or (2) JumpURL method."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples desbordamientos de b\u00fafer en el control ActiveX KeyHelp.KeyCtrl.1 en KeyHelp.ocx v1.2.312 en KeyWorks KeyHelp Module (tambi\u00e9n conocido como el componente HTML Help), tal como se utiliza en EMC Documentum ApplicationXtender Desktop v5.4; EMC Captiva Quickscan Pro v4.6 SP1; GE Intelligent Platforms Proficy Historian v3.1, v3.5, v4.0 y v4.5; GE Intelligent Platforms Proficy HMI/SCADA iFIX v5.0 y v5.1; Proficy Pulse v1,0; Proficy Batch Execution v5,6, SI7 ??E/S Driverv 7.20 hasta 7.42, y otros productos, permite a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de una larga cadena en el segundo argumento del m\u00e9todo (1) JumpMappedID o (2) JumpURL."
    }
  ],
  "id": "CVE-2012-2515",
  "lastModified": "2026-06-16T23:41:37.450",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2012-07-05T03:23:18.480",
  "references": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Exploit"
      ],
      "url": "http://retrogod.altervista.org/9sg_emc_keyhelp.html"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36905"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36914"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://support.ge-ip.com/support/resources/sites/GE_FANUC_SUPPORT/content/live/KB/14000/KB14863/en_US/GEIP12-04%20Security%20Advisory%20-%20Proficy%20HTML%20Help.pdf"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/36546"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-131-02.pdf"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "url": "http://www.vupen.com/english/advisories/2009/2793"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "url": "http://www.vupen.com/english/advisories/2009/2795"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://retrogod.altervista.org/9sg_emc_keyhelp.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36905"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36914"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://support.ge-ip.com/support/resources/sites/GE_FANUC_SUPPORT/content/live/KB/14000/KB14863/en_US/GEIP12-04%20Security%20Advisory%20-%20Proficy%20HTML%20Help.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/36546"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-131-02.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2009/2793"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2009/2795"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.