PT-2010-4575 · Techsmith · Snagit

Encrypt3D.M!Nd · Published 2010-08-26 · Updated 2020-05-13 · CVE-2010-3130

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TechSmith Snagit versions 10.x through 11.x

Description The issue allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks. This can be achieved via a Trojan horse dwmapi.dll located in the same folder as a snag, snagcc, or snagprof file.

Recommendations For versions 10.x through 11.x, update to a version that is not affected by this issue, as no specific fix is provided for these versions. As a temporary workaround, consider restricting access to the dwmapi.dll file to minimize the risk of exploitation. Avoid executing files from untrusted sources, and ensure that all files are scanned for malware before execution.

Exploit

Fix

Related Identifiers

CVE-2010-3130

Affected Products

Snagit

References · 5

• 🔥 http://exploit-db.com/exploits/14764 · Exploit
• 🔥 https://exploit-db.com/exploits/14764 · Exploit
• http://secunia.com/advisories/41124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3130 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6668 · Note