PT-2010-5200 · Microsoft · Windows Vista+4

Published 2010-12-16 · Updated 2023-12-07 · CVE-2010-3965

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Media Encoder 9 versions on Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, and Windows Server 2008 Gold and SP2

Description The issue allows local users to gain privileges via a Trojan horse DLL in the current working directory. This can be demonstrated by a directory that contains a Windows Media Profile (PRX) file. The problem is related to an untrusted search path vulnerability, also referred to as an "Insecure Library Loading Vulnerability."

Recommendations For Windows Media Encoder 9 on the affected Microsoft Windows versions, consider restricting access to the current working directory to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2010-3965

Affected Products

Windows Media Encoder 9

Windows Server 2003

Windows Server 2008

Windows Vista

Windows Xp

References · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-094 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3965 · Security Note
• http://vupen.com/english/advisories/2010/3217 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12235 · Note
• http://securitytracker.com/id?1024876 · Note
• http://us-cert.gov/cas/techalerts/TA10-348A.html · Note
• http://securityfocus.com/bid/42855 · Note