PT-2010-3508 · Microsoft · Windows Help/Support Center+3

Tavis Ormandy · Published 2010-06-14 · Updated 2019-02-26 · CVE-2010-1885

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Help and Support Center versions in Windows XP and Windows Server 2003

Description The issue concerns a problem with handling malformed escape sequences in the Microsoft Windows Help and Support Center, allowing remote attackers to bypass the trusted documents whitelist and execute arbitrary commands via a crafted hcp:// URL. An unauthenticated remote code execution vulnerability exists in the way that the Microsoft Help and Support Center validates specially crafted URLs. This could allow remote code execution if a user views a specially crafted Web page or clicks a specially crafted link in an e-mail message, potentially enabling an attacker to execute arbitrary code, install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Windows XP and Windows Server 2003, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2010-1885

Affected Products

Windows Help/Support Center

Windows

Windows Server 2003

Windows Xp

References · 22

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_042_helpctr_xss_cmd_exec.rb · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2010-06/0197.html · Exploit
• 🔥 http://exploit-db.com/exploits/13808 · Exploit
• 🔥 https://exploit-db.com/exploits/16545 · Exploit
• 🔥 https://exploit-db.com/exploits/13808 · Exploit
• 🔥 http://securityfocus.com/bid/40725 · Exploit
• http://secunia.com/advisories/40076 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1885 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-1885 · Security Note
• http://microsoft.com/technet/security/advisory/2219475.mspx · Vendor Advisory
• http://blogs.technet.com/b/srd/archive/2010/06/10/help-and-support-center-vulnerability-full-disclosure-posting.aspx · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-042 · Vendor Advisory
• http://vupen.com/english/advisories/2010/1417 · Vendor Advisory
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-042 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/59267 · Note