| Vulnerability Name: | CVE-2010-3140 (CCN-63787) | ||||||||
| Assigned: | 2010-08-23 | ||||||||
| Published: | 2010-08-23 | ||||||||
| Updated: | 2017-09-19 | ||||||||
| Summary: | Untrusted search path vulnerability in Microsoft Windows Internet Communication Settings on Windows XP SP3 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse schannel.dll that is located in the same folder as an ISP file. Per: http://cwe.mitre.org/data/definitions/426.html 'CWE-426 - 'Untrusted Search Path Vulnerability' | ||||||||
| CVSS v3 Severity: | 10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||||
| CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C) 8.0 High (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:POC/RL:W/RC:C)
8.0 High (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:POC/RL:W/RC:C)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2010-3140 Source: EXPLOIT-DB Type: Exploit 14780 Source: CCN Type: Microsoft Security Advisory (2269637) Insecure Library Loading Could Allow Remote Code Execution Source: CCN Type: OSVDB ID: 67552 Microsoft Windows Internet Communication Settings Path Subversion Arbitrary DLL Injection Code Execution Source: CCN Type: BID-42762 Microsoft Windows Internet Communication Settings DLL Loading Arbitrary Code Execution Vulnerability Source: XF Type: UNKNOWN windowsics-dll-ce(63787) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:6743 Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database Source: EXPLOIT-DB Type: EXPLOIT EDB-ID: 14780 | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||