PT-2010-3508 · Microsoft · Windows Help/Support Center+3

Tavis Ormandy · Publicado 2010-06-14 · Atualizado 2019-02-26 · CVE-2010-1885

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Help and Support Center versions in Windows XP and Windows Server 2003

Description The issue concerns a problem with handling malformed escape sequences in the Microsoft Windows Help and Support Center, allowing remote attackers to bypass the trusted documents whitelist and execute arbitrary commands via a crafted hcp:// URL. An unauthenticated remote code execution vulnerability exists in the way that the Microsoft Help and Support Center validates specially crafted URLs. This could allow remote code execution if a user views a specially crafted Web page or clicks a specially crafted link in an e-mail message, potentially enabling an attacker to execute arbitrary code, install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Windows XP and Windows Server 2003, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2010-1885

Produtos afetados

Windows Help/Support Center

Windows

Windows Server 2003

Windows Xp

Referências · 22

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_042_helpctr_xss_cmd_exec.rb · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2010-06/0197.html · Exploit
• 🔥 http://exploit-db.com/exploits/13808 · Exploit
• 🔥 https://exploit-db.com/exploits/16545 · Exploit
• 🔥 https://exploit-db.com/exploits/13808 · Exploit
• 🔥 http://securityfocus.com/bid/40725 · Exploit
• http://secunia.com/advisories/40076 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1885 · Nota de Segurança
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-042 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/59267 · Nota
• http://us-cert.gov/cas/techalerts/TA10-194A.html · Nota
• http://kb.cert.org/vuls/id/578319 · Nota
• http://securitytracker.com/id?1024084 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11733 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1885 · Nota de Segurança