9.3

CVE-2010-2568

Warnung
Medienbericht
Exploit
Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Windows 7 Version -
Microsoft ≫ Windows Server 2003 Version - Update sp2
Microsoft ≫ Windows Server 2008 Version - Update -
Microsoft ≫ Windows Server 2008 Version - Update sp2
Microsoft ≫ Windows Server 2008 Version r2 HwPlatform itanium
Microsoft ≫ Windows Server 2008 Version r2 HwPlatform x64
Microsoft ≫ Windows Vista Version - Update sp1
Microsoft ≫ Windows Vista Version - Update sp2
Microsoft ≫ Windows Xp Version - Update sp2 SwEdition professional HwPlatform x64
Microsoft ≫ Windows Xp Version - Update sp3

15.09.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft Windows Remote Code Execution Vulnerability

Schwachstelle

Microsoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the operating system displays the icon of a malicious shortcut file. An attacker who successfully exploited this vulnerability could execute code as the logged-on user.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 91.32% 0.998
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CISA-ADP 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.us-cert.gov/cas/techalerts/TA10-222A.html
Third Party Advisory
US Government Resource
http://isc.sans.edu/diary.html?storyid=9181
Exploit
Issue Tracking
http://isc.sans.edu/diary.html?storyid=9190
Issue Tracking
http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/
Press/Media Coverage
http://secunia.com/advisories/40647
Vendor Advisory
http://securitytracker.com/id?1024216
Third Party Advisory
Broken Link
VDB Entry
http://www.f-secure.com/weblog/archives/00001986.html
Not Applicable
http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf
Exploit
http://www.kb.cert.org/vuls/id/940193
Patch
Third Party Advisory
US Government Resource
http://www.microsoft.com/technet/security/advisory/2286198.mspx
Patch
Vendor Advisory
Broken Link
http://www.securityfocus.com/bid/41732
Third Party Advisory
Exploit
Broken Link
VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046
Patch
Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11564
Broken Link
https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm
Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2568
US Government Resource