What’s Vulnerable › Vulnerabilities

CVE-2012-5896

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 68.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2012-11-17 · updated 2026-06-16

Description

The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not properly implement the Add method, which allows remote attackers to execute arbitrary code via a memory address in the first argument, related to an "uninitialized pointer."

Affected products

• Quest Intrust: through 10.4.0.853; 10.1, 10.2.5, 10.3, 10.4

References

• http://archives.neohapsis.com/archives/bugtraq/2012-03/0153.html
• http://dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/intrust_annotatex_add.rb
• http://osvdb.org/80662
• http://packetstormsecurity.org/files/111312/Quest-InTrust-10.4.x-Annotation-Objects-Code-Execution.html
• http://packetstormsecurity.org/files/111853/Quest-InTrust-Annotation-Objects-Uninitialized-Pointer.html
• http://secunia.com/advisories/48566
• http://www.exploit-db.com/exploits/18674
• http://www.securityfocus.com/bid/52765
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74448
• http://archives.neohapsis.com/archives/bugtraq/2012-03/0153.html
• http://dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/intrust_annotatex_add.rb
• http://osvdb.org/80662

Get alerted when CVE-2012-5896 or the next vulnerability affects your stack