PT-2012-1325 · Microsoft · Windows Server 2008+1

Shinnai · Published 2012-01-17 · Updated 2018-10-12 · CVE-2010-5082

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2008 SP2, R2, and R2 SP1

Description The issue allows local users to gain privileges via a Trojan horse sti.dll file in the current working directory. This can be demonstrated by a directory that contains a .camp, .cdmp, .gmmp, .icc, or .icm file. A remote code execution vulnerability exists in the way that the Color Control Panel handles the loading of DLL files, which could allow an attacker to take complete control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Windows Server 2008 SP2, R2, and R2 SP1, consider restricting access to the Color Control Panel until a patch is available. As a temporary workaround, avoid using directories that contain .camp, .cdmp, .gmmp, .icc, or .icm files to minimize the risk of exploitation. Restrict user rights on the system to minimize the impact of a potential attack.

Fix

Related Identifiers

CVE-2010-5082

Affected Products

Windows Server 2008

Windows

References · 7

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5082 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-012 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-5082 · Security Note
• http://shinnai.altervista.org/exploits/SH-006-20100914.html · Note
• http://us-cert.gov/cas/techalerts/TA12-045A.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14446 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms12-012 · Note