PT-2012-1325 · Microsoft · Windows Server 2008+1

Shinnai · Publicado 2012-01-17 · Atualizado 2018-10-12 · CVE-2010-5082

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2008 SP2, R2, and R2 SP1

Description The issue allows local users to gain privileges via a Trojan horse sti.dll file in the current working directory. This can be demonstrated by a directory that contains a .camp, .cdmp, .gmmp, .icc, or .icm file. A remote code execution vulnerability exists in the way that the Color Control Panel handles the loading of DLL files, which could allow an attacker to take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Windows Server 2008 SP2, R2, and R2 SP1, consider restricting access to the Color Control Panel until a patch is available. As a temporary workaround, avoid using directories that contain .camp, .cdmp, .gmmp, .icc, or .icm files to minimize the risk of exploitation. Restrict user rights on the system to minimize the impact of a potential attack.

Correção

Identificadores relacionados

CVE-2010-5082

Produtos afetados

Windows Server 2008

Windows

Referências · 7

• http://shinnai.altervista.org/exploits/SH-006-20100914.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5082 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-012 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-5082 · Nota de Segurança
• http://us-cert.gov/cas/techalerts/TA12-045A.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14446 · Nota
• http://technet.microsoft.com/en-us/security/bulletin/ms12-012 · Nota