PT-2010-4593 · Microsoft · Office Visio

Beenu Arora · Publicado 2010-08-27 · Atualizado 2018-10-12 · CVE-2010-3148

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Visio version 2003 SP3

Description The issue allows local users to gain privileges via a Trojan horse mfc71enu.dll file in the current working directory. This can be demonstrated by a directory that contains a .vsd, .vdx, .vst, or .vtx file. A remote code execution vulnerability exists in the way that Microsoft Visio handles the loading of DLL files, which could allow an attacker to take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Visio version 2003 SP3, as a temporary workaround, consider restricting access to the mfc71enu.dll file until a patch is available. Avoid using directories that contain .vsd, .vdx, .vst, or .vtx files in the current working directory to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2010-3148

Produtos afetados

Office Visio

Referências · 9

• 🔥 https://exploit-db.com/exploits/14744 · Exploit
• 🔥 http://exploit-db.com/exploits/14744 · Exploit
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS11-055 · Nota
• http://vupen.com/english/advisories/2010/2192 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7122 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3148 · Nota de Segurança
• http://us-cert.gov/cas/techalerts/TA11-193A.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3148 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-055 · Aviso do Fabricante