| Vulnerability Name: | CCN-64474 | ||||||
| Published: | 2010-12-15 | ||||||
| Updated: | 2010-12-15 | ||||||
| Summary: | Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by the loading of the Microsoft HTML Help application (hh.exe) in an insecure manner by the Remote Access Phonebook (rasphone.exe). By persuading a victim to open a specially-crafted PBK file from a WebDAV or SMB share using a vulnerable application, a remote attacker could exploit this vulnerability via a specially-crafted library to execute arbitrary code on the system. | ||||||
| CVSS v3 Severity: | 10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||
| CVSS v2 Severity: | 9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C) 7.5 High (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:U/RC:UR)
| ||||||
| Vulnerability Consequences: | Gain Access | ||||||
| References: | Source: CCN Type: SA42527 Microsoft Remote Access Phonebook Insecure Executable Loading Vulnerability Source: CCN Type: Microsoft Web site Microsoft Windows Source: CCN Type: OSVDB ID: 70000 Microsoft Windows Remote Access Phonebook (rasphone.exe) Path Subversion Arbitrary EXE Injection Code Execution Source: CCN Type: BID-45404 Microsoft Windows Remote Access Phonebook Executable Loading Arbitrary Code Execution Vulnerability Source: XF Type: UNKNOWN ms-win-phonebook-code-exec(64474) | ||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||
| BACK | |||||||