PT-2010-4793 · Qualcomm · Qxdm

Published 2010-09-16 · Updated 2010-09-17 · CVE-2010-3403

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm eXtensible Diagnostic Monitor (QXDM) version 03.09.19

Description The issue allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks. This can be achieved via a Trojan horse mfc71enu.dll that is located in the same folder as a .isf file.

Recommendations For Qualcomm eXtensible Diagnostic Monitor (QXDM) version 03.09.19, consider restricting access to the folder where .isf files are located to prevent the placement of malicious mfc71enu.dll files. As a temporary workaround, avoid using .isf files from untrusted sources until a patch is available.

Fix

Related Identifiers

CVE-2010-3403

Affected Products

Qxdm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2010-3403 · Security Note
• http://secunia.com/advisories/41309 · Vendor Advisory
• http://exploit-db.com/dll-hijacking-vulnerable-applications · Note
• http://osvdb.org/67991 · Note