PT-2010-2248 · Microsoft · Windows

Published 2010-04-14 · Updated 2023-12-07 · CVE-2010-0487

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue arises from the improper use of unspecified fields in a file digest by the Authenticode Signature verification functionality, allowing remote attackers to execute arbitrary code via a modified cabinet file that incorrectly appears to have a valid signature. A remote code execution vulnerability exists in the Windows Authenticode Signature verification for cabinet file formats, which could be exploited by an anonymous attacker modifying an existing signed cabinet file to point to malicious code and convincing a user to open the specially crafted file. This could allow an attacker to take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Windows versions prior to the fixed version, update to a version that includes the fix for the Cabview Corruption Validation Vulnerability to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-0487

Affected Products

Windows

References · 6

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-019 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0487 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-0487 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6886 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-019 · Note
• http://us-cert.gov/cas/techalerts/TA10-103A.html · Note