PT-2010-1167 · Microsoft+1 · Windows Shell+3

Andreas Marx + 6 · Published 2010-07-22 · Updated 2025-08-15 · CVE-2010-2568

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7

Description The issue is related to errors in processing files with .LNK (or .PIF) extensions. Exploitation of this issue can allow a remote attacker to execute arbitrary code using a specially crafted .LNK (or .PIF) file. This can occur when Windows Explorer improperly handles icon display for such files. The issue has been demonstrated in the wild and was originally reported for malware leveraging vulnerabilities in Siemens WinCC SCADA systems. An estimated number of affected devices is not provided, but the issue has been observed in real-world incidents. Technical details include the exploitation of Windows Shell in Microsoft Windows, where a crafted (1) .LNK or (2) .PIF shortcut file is not properly handled during icon display.

Recommendations For Microsoft Windows versions XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7, apply the update that addresses the vulnerability previously discussed in Microsoft Security Advisory 2286198 to prevent arbitrary code execution when the operating system displays the icon of a malicious shortcut file. As a temporary workaround, consider restricting access to .LNK and .PIF files to minimize the risk of exploitation until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-04410

CVE-2010-2568

Affected Products

Wincc Scada

Windows

Windows Explorer

Windows Shell

References · 31

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/forensics/fanny_bmp_check.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/ms10_046_shortcut_icon_dllloader.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_046_shortcut_icon_dllloader.rb · Exploit
• 🔥 https://exploit-db.com/exploits/14403 · Exploit
• 🔥 http://isc.sans.edu/diary.html?storyid=9181 · Exploit
• 🔥 http://securityfocus.com/bid/41732 · Exploit
• 🔥 http://f-secure.com/weblog/archives/new_rootkit_en.pdf · Exploit
• 🔥 https://exploit-db.com/exploits/16574 · Exploit
• http://microsoft.com/technet/security/advisory/2286198.mspx · Vendor Advisory
• http://kb.cert.org/vuls/id/940193 · Patch
• https://bdu.fstec.ru/vul/2021-04410 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-2568 · Security Note
• http://secunia.com/advisories/40647 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2568 · Security Note
• https://t.me/cvenotify/118101 · Telegram Post