PT-2010-5196 · Microsoft · Windows Vista+3

Cesar Cerrudo · Publicado 2010-12-16 · Atualizado 2023-12-07 · CVE-2010-3961

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Vista versions SP1 through SP2 Microsoft Windows Server 2008 versions Gold through SP2 and R2 Microsoft Windows 7 (affected versions not specified)

Description The issue arises from the Consent User Interface (UI) not properly handling an unspecified registry-key value. This allows local users with SeImpersonatePrivilege rights to gain privileges via a crafted application. The vulnerability could allow an attacker to run code with elevated privileges, potentially executing arbitrary code and taking complete control of an affected system. This could enable the attacker to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Windows Vista versions SP1 through SP2, update to a version that properly handles registry-key values to prevent elevation of privilege. For Microsoft Windows Server 2008 versions Gold through SP2 and R2, apply a configuration change to restrict the Consent UI's ability to process special registry values. For Microsoft Windows 7, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-3961

Produtos afetados

Windows

Windows 7

Windows Server 2008

Windows Vista

Referências · 11

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-100 · Aviso do Fabricante
• http://osvdb.org/69824 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3961 · Nota de Segurança
• http://secunia.com/advisories/42614 · Aviso do Fabricante
• http://securityfocus.com/bid/45318 · Nota
• http://us-cert.gov/cas/techalerts/TA10-348A.html · Nota
• http://securitytracker.com/id?1024882 · Nota
• http://vupen.com/english/advisories/2010/3222 · Aviso do Fabricante
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-100 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3961 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12323 · Nota