PT-2010-4793 · Qualcomm · Qxdm

Publicado 2010-09-16 · Atualizado 2010-09-17 · CVE-2010-3403

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm eXtensible Diagnostic Monitor (QXDM) version 03.09.19

Description The issue allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks. This can be achieved via a Trojan horse mfc71enu.dll that is located in the same folder as a .isf file.

Recommendations For Qualcomm eXtensible Diagnostic Monitor (QXDM) version 03.09.19, consider restricting access to the folder where .isf files are located to prevent the placement of malicious mfc71enu.dll files. As a temporary workaround, avoid using .isf files from untrusted sources until a patch is available.

Correção

Identificadores relacionados

CVE-2010-3403

Produtos afetados

Qxdm

Referências · 4

• http://exploit-db.com/dll-hijacking-vulnerable-applications · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3403 · Nota de Segurança
• http://osvdb.org/67991 · Nota
• http://secunia.com/advisories/41309 · Aviso do Fabricante