PT-2010-4102 · Microsoft · Windows Server 2008+3
Cesar Cerrudo
·
Published
2010-08-11
·
Updated
2025-01-21
·
CVE-2010-2554
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Microsoft Windows Vista versions SP1 through SP2
Microsoft Windows Server 2008 versions Gold through SP2 and R2
Microsoft Windows 7 (affected versions not specified)
Description
The issue arises from incorrect access control lists (ACLs) on the registry keys for the Tracing Feature for Services in Microsoft Windows. This could allow an attacker to run code with elevated privileges, potentially leading to the execution of arbitrary code and complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.
Recommendations
For Microsoft Windows Vista versions SP1 through SP2, update to a version with the correct ACLs on the registry keys for the Tracing Feature for Services.
For Microsoft Windows Server 2008 versions Gold through SP2 and R2, update to a version with the correct ACLs on the registry keys for the Tracing Feature for Services.
For Microsoft Windows 7, update to a version with the correct ACLs on the registry keys for the Tracing Feature for Services.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Windows
Windows 7
Windows Server 2008
Windows Vista