PT-2010-4591 · Microsoft · Groove 2007

Beenu Arora · Published 2010-08-27 · Updated 2018-10-12 · CVE-2010-3146

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Groove 2007 SP2

Description The issue allows local users to gain privileges via a Trojan horse mso.dll or GroovePerfmon.dll file in the current working directory. This can be demonstrated by a directory that contains a Groove vCard (.vcg) or Groove Tool Archive (.gta) file.

Recommendations For Microsoft Groove 2007 SP2, consider restricting access to the mso.dll and GroovePerfmon.dll files to minimize the risk of exploitation. Avoid using directories that contain Groove vCard (.vcg) or Groove Tool Archive (.gta) files with potentially untrusted search paths until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2010-3146

Affected Products

Groove 2007

References · 7

• 🔥 https://exploit-db.com/exploits/14746 · Exploit
• 🔥 http://exploit-db.com/exploits/14746 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-016 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3146 · Security Note
• http://vupen.com/english/advisories/2010/2188 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12632 · Note
• http://us-cert.gov/cas/techalerts/TA11-067A.html · Note