PT-2010-5340 · Microsoft · Windows Xp Professional+3

Publicado 2010-11-04 · Atualizado 2021-07-07 · CVE-2010-4182

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows XP Professional version SP3 Microsoft Windows Server 2003 R2 Enterprise Edition version SP3 Microsoft Windows Vista Business version SP1 Microsoft Windows 7 Professional (affected versions not specified)

Description The issue concerns an untrusted search path vulnerability in the Data Access Objects (DAO) library, specifically in the dao360.dll file. This vulnerability allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks. The attack can be carried out via a Trojan horse msjet49.dll located in the same folder as a file processed by dao360.dll.

Recommendations For Microsoft Windows XP Professional SP3, update to a newer version to mitigate the risk. For Microsoft Windows Server 2003 R2 Enterprise Edition SP3, update to a newer version to mitigate the risk. For Microsoft Windows Vista Business SP1, update to a newer version to mitigate the risk. For Microsoft Windows 7 Professional, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2010-4182

Produtos afetados

Windows 7 Professional

Windows Server 2003 R2 Enterprise Edition

Windows Vista Business

Windows Xp Professional

Referências · 4

• http://secunia.com/advisories/41986 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-4182 · Nota de Segurança
• http://osvdb.org/68946 · Nota
• http://securityfocus.com/bid/44541 · Nota