PT-2010-2037 · Microsoft · Windows 2000+2

Gynvael Coldwind + 2 · Publicado 2010-04-14 · Atualizado 2018-10-12 · CVE-2010-0237

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows 2000 SP4 Microsoft Windows XP SP2 Microsoft Windows XP SP3

Description An elevation of privilege issue exists due to improper restriction of symbolic link creation between untrusted and trusted registry hives. This could allow an attacker to run arbitrary code in kernel mode, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Windows 2000 SP4, update to a version that includes the fix for this issue. For Microsoft Windows XP SP2, update to a version that includes the fix for this issue. For Microsoft Windows XP SP3, update to a version that includes the fix for this issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-0237

Produtos afetados

Windows

Windows 2000

Windows Xp

Referências · 8

• http://securitytracker.com/id?1023850 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-021 · Aviso do Fabricante
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-021 · Nota
• http://secunia.com/advisories/39373 · Nota
• http://us-cert.gov/cas/techalerts/TA10-103A.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0237 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7130 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0237 · Nota de Segurança