PT-2010-5206 · Microsoft · Wmi Administrative Tools+2

牛奶坦克 · Published 2010-12-23 · Updated 2018-10-12 · CVE-2010-3973

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft WMI Administrative Tools version 1.1 and earlier

Description A remote code execution issue exists in one of the Microsoft WMITools ActiveX controls, potentially allowing an attacker to execute arbitrary code via a crafted argument to the AddContextRef method. This could be related to an untrusted pointer dereference. An attacker could exploit this issue by constructing a specially crafted Web page. When a user views the Web page, the issue could allow remote code execution, potentially giving the attacker the same user rights as the logged-on user.

Recommendations For Microsoft WMI Administrative Tools version 1.1 and earlier, consider disabling the AddContextRef method in the WBEMSingleView.ocx ActiveX control as a temporary workaround until a patch is available. Restrict access to the WBEMSingleView.ocx control to minimize the risk of exploitation.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2010-3973

Affected Products

Wmi Administrative Tools

Wbemsingleview.Ocx

Windows

References · 17

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/wmi_admintools.rb · Exploit
• 🔥 http://exploit-db.com/exploits/15809 · Exploit
• 🔥 http://wooyun.org/bug.php?action=view&id=1006 · Exploit
• 🔥 https://exploit-db.com/exploits/15809 · Exploit
• 🔥 http://securityfocus.com/bid/45546 · Exploit
• 🔥 https://exploit-db.com/exploits/16516 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-3973 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-027 · Vendor Advisory
• http://vupen.com/english/advisories/2010/3301 · Vendor Advisory
• http://secunia.com/advisories/42693 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3973 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12475 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS11-027 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64250 · Note
• http://blogs.technet.com/b/srd/archive/2011/01/07/assessing-the-risk-of-public-issues-currently-being-tracked-by-the-msrc.aspx · Note