PT-2010-5474 · Microsoft · Windows Vista+5

Guo Bojun + 3 · Published 2010-12-03 · Updated 2025-04-03 · CVE-2010-4398

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to Windows XP SP4, Windows Server 2003 SP3, Windows Vista SP3, Windows Server 2008 SP3, and Windows 7 SP1

Description An elevation of privilege issue exists due to the improper interaction of drivers with the Windows kernel. This allows local users to gain privileges and bypass the User Account Control (UAC) feature via a crafted REG BINARY value for a SystemDefaultEUDCFont registry key. An attacker who successfully exploited this issue could run arbitrary code in kernel mode and take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full administrative rights.

Recommendations For Microsoft Windows XP SP2 and SP3, update to Windows XP SP4 to resolve the issue. For Windows Server 2003 SP2, update to Windows Server 2003 SP3 to resolve the issue. For Windows Vista SP1 and SP2, update to Windows Vista SP3 to resolve the issue. For Windows Server 2008 Gold, SP2, and R2, update to Windows Server 2008 SP3 to resolve the issue. For Windows 7, update to Windows 7 SP1 to resolve the issue. As a temporary workaround, consider restricting access to the SystemDefaultEUDCFont registry key to minimize the risk of exploitation.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2010-4398

Affected Products

Windows

Windows 7

Windows Server 2003

Windows Server 2008

Windows Vista

Windows Xp

References · 21

• 🔥 http://isc.sans.edu/diary.html?storyid=9988 · Exploit
• 🔥 http://exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror · Exploit
• 🔥 https://exploit-db.com/exploits/15609 · Exploit
• 🔥 http://exploit-db.com/exploits/15609 · Exploit
• http://secunia.com/advisories/42356 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4398 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-4398 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-011 · Vendor Advisory
• http://support.avaya.com/css/P8/documents/100127248 · Note
• http://kb.cert.org/vuls/id/529673 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS11-011 · Note
• https://t.me/cvenotify/117649 · Telegram Post
• https://t.me/cvenotify/85572 · Telegram Post
• http://vupen.com/english/advisories/2011/0324 · Note
• http://twitter.com/msftsecresponse/statuses/7590788200402945 · Note