PT-2010-2244 · Microsoft · Winhlp32.Exe+2

Published 2010-03-03 · Updated 2019-02-26 · CVE-2010-0483

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VBScript versions 5.1, 5.6, 5.7, and 5.8 in Microsoft Windows

Description The issue allows user-assisted remote attackers to execute arbitrary code by referencing a local pathname, UNC share pathname, or WebDAV server with a crafted .hlp file in the fourth argument (aka helpfile argument) to the MsgBox function, leading to code execution involving winhlp32.exe when the F1 key is pressed.

Recommendations For VBScript versions 5.1, 5.6, 5.7, and 5.8, consider disabling the MsgBox function until a patch is available. Restrict access to the winhlp32.exe to minimize the risk of exploitation. Avoid using the helpfile argument in the MsgBox function until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2010-0483

Affected Products

Vbscript

Windows

Winhlp32.Exe

References · 24

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_022_ie_vbscript_winhlp32.rb · Exploit
• 🔥 http://isec.pl/vulnerabilities10.html · Exploit
• 🔥 http://securityfocus.com/bid/38463 · Exploit
• 🔥 https://exploit-db.com/exploits/11615 · Exploit
• 🔥 https://metasploit.com/svn/framework3/trunk/modules/exploits/windows/browser/ie_winhlp32.rb · Exploit
• 🔥 http://isec.pl/vulnerabilities/isec-0027-msgbox-helpfile-ie.txt · Exploit
• 🔥 https://exploit-db.com/exploits/16541 · Exploit
• http://blogs.technet.com/msrc/archive/2010/02/28/investigating-a-new-win32hlp-and-internet-explorer-issue.aspx · Vendor Advisory
• http://blogs.technet.com/msrc/archive/2010/03/01/security-advisory-981169-released.aspx · Vendor Advisory
• http://secunia.com/advisories/38727 · Vendor Advisory
• http://blogs.technet.com/srd/archive/2010/03/01/help-keypress-vulnerability-in-vbscript-enabling-remote-code-execution.aspx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0483 · Security Note
• http://microsoft.com/technet/security/advisory/981169.mspx · Vendor Advisory
• http://vupen.com/english/advisories/2010/0485 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-022 · Vendor Advisory