CVE-2010-2568
HIGH
7,8
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
HIGH
9,3
Source: [email protected]
Access Vector: network
Access Complexity: medium
Authentication: none
Confidentiality: complete
Integrity: complete
Availability: complete
Description
AI Translation Available
Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,9279
Percentile
1,0th
Updated
EPSS Score Trend (Last 91 Days)
Exploit
Microsoft Windows - Automatic .LNK Shortcut File Code …
VerifiedMicrosoft Windows - Automatic .LNK Shortcut File Code Execution
View Exploit Code →
Exploit
Microsoft Windows - Shell LNK Code Execution (MS10-046) …
Verified Metasploit Framework (MSF)Microsoft Windows - Shell LNK Code Execution (MS10-046) (Metasploit)
View Exploit Code →
Operating System
Windows Server 2003 by Microsoft
CPE Identifier
View Detailed Analysis
cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Windows Vista by Microsoft
CPE Identifier
View Detailed Analysis
cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Windows Server 2008 by Microsoft
CPE Identifier
View Detailed Analysis
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Windows Server 2008 by Microsoft
CPE Identifier
View Detailed Analysis
cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Windows Server 2008 by Microsoft
CPE Identifier
View Detailed Analysis
cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Windows Vista by Microsoft
CPE Identifier
View Detailed Analysis
cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Windows Server 2008 by Microsoft
CPE Identifier
View Detailed Analysis
cpe:2.3:o:microsoft:windows_server_2008:-:-:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Windows Xp by Microsoft
CPE Identifier
View Detailed Analysis
cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Windows Xp by Microsoft
CPE Identifier
View Detailed Analysis
cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Windows 7 by Microsoft
CPE Identifier
View Detailed Analysis
cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010…
http://isc.sans.edu/diary.html?storyid=9181
http://isc.sans.edu/diary.html?storyid=9190
http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-0…
http://secunia.com/advisories/40647
http://securitytracker.com/id?1024216
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%…
https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm
http://www.f-secure.com/weblog/archives/00001986.html
http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf
http://www.kb.cert.org/vuls/id/940193
http://www.microsoft.com/technet/security/advisory/2286198.mspx
http://www.securityfocus.com/bid/41732
http://www.us-cert.gov/cas/techalerts/TA10-222A.html
http://isc.sans.edu/diary.html?storyid=9181
http://isc.sans.edu/diary.html?storyid=9190
http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-0…
http://secunia.com/advisories/40647
http://securitytracker.com/id?1024216
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%…
https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm
http://www.f-secure.com/weblog/archives/00001986.html
http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf
http://www.kb.cert.org/vuls/id/940193
http://www.microsoft.com/technet/security/advisory/2286198.mspx
http://www.securityfocus.com/bid/41732
http://www.us-cert.gov/cas/techalerts/TA10-222A.html