PT-2010-1153 · Microsoft+1 · Exchange Server 2010+11

Stefan Kanthak · Published 2010-08-31 · Updated 2020-11-16 · CVE-2010-3190

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Visual Studio .NET 2003 SP1 Microsoft Visual Studio 2005 SP1 Microsoft Visual Studio 2008 SP1 Microsoft Visual Studio 2010 Microsoft Visual C++ 2005 SP1 Microsoft Visual C++ 2008 SP1 Microsoft Visual C++ 2010 Microsoft Exchange Server 2010 Service Pack 3 Microsoft Exchange Server 2013

Description The issue is related to an untrusted search path vulnerability in the Microsoft Foundation Class (MFC) Library, which allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory during execution of an MFC application. This can be demonstrated by a directory that contains a TRC, cur, rs, rct, or res file. A remote code execution vulnerability also exists in the way that certain applications built with Microsoft Foundation Classes (MFC) handle the loading of DLL files, potentially allowing an attacker to take complete control of an affected system.

Recommendations For Microsoft Visual Studio .NET 2003 SP1, consider disabling the execution of MFC applications until a patch is available. For Microsoft Visual Studio 2005 SP1, 2008 SP1, and 2010, restrict access to the MFC Library to minimize the risk of exploitation. For Microsoft Visual C++ 2005 SP1, 2008 SP1, and 2010, avoid using the dwmapi.dll file in the current working directory until the issue is resolved. For Microsoft Exchange Server 2010 Service Pack 3 and 2013, restrict access to the MFC Library and consider disabling the execution of MFC applications until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Untrusted Search Path

Weakness Enumeration

CWE-426

CWE-264

Related Identifiers

BDU:2019-00031

CVE-2010-3190

Affected Products

Exchange Server

Mfc Library

Exchange Server 2010

Exchange Server 2013

Visual C++ 2005

Visual C++ 2008

Visual C++ 2010

Visual Studio .Net 2003

Visual Studio 2005

Visual Studio 2008

Visual Studio 2010

Itunes

References · 13

• http://lists.apple.com/archives/security-announce/2015/Sep/msg00003.html · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-025 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3190 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2010-3190 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00031 · Security Note
• https://support.apple.com/HT205221 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3190 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/686190 · Security Note
• http://securityfocus.com/bid/42811 · Note
• http://secunia.com/advisories/41212 · Note
• http://corelan.be:8800/index.php/2010/08/25/dll-hijacking-kb-2269637-the-unofficial-list · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12457 · Note
• http://us-cert.gov/cas/techalerts/TA11-102A.html · Note