Vulnerability Name:

CVE-2010-5204 (CCN-63832)

Assigned:2010-08-23
Published:2010-08-23
Updated:2012-09-13
Summary:Multiple untrusted search path vulnerabilities in IBM Lotus Symphony 1.3.0 20090908.0900 allow local users to gain privileges via a Trojan horse (1) eclipse_1114.dll or (2) emser645mi.dll file in the current working directory, as demonstrated by a directory that contains a .odm, .odt, .otp, .stc, .stw, .sxg, or .sxw file.
Note: some of these details are obtained from third party information.
Per: http://cwe.mitre.org/data/definitions/426.html

'CWE-426 Untrusted Search Path'
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.9 Medium (CVSS v2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C)
5.9 Medium (Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C/E:POC/RL:W/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
8.0 High (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:POC/RL:W/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: MISC
Type: UNKNOWN
http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/%5Bibm_lotus_symphony%5D_3-beta-4_insecure_dll_hijacking

Source: MITRE
Type: CNA
CVE-2010-5204

Source: CCN
Type: SA41400
IBM Lotus Symphony Insecure Library Loading Vulnerability

Source: SECUNIA
Type: Vendor Advisory
41400

Source: CCN
Type: IBM Web site
Lotus Symphony

Source: CCN
Type: Microsoft Security Advisory (2269637)
Insecure Library Loading Could Allow Remote Code Execution

Source: CCN
Type: OSVDB ID: 68010
IBM Lotus Symphony Path Subversion Arbitrary DLL Injection Code Execution

Source: CCN
Type: BID-43170
IBM Lotus Symphony 'eclipse_1114.dll' DLL Loading Arbitrary Code Execution Vulnerability

Source: XF
Type: UNKNOWN
ibmlotussymphony-dll-ce(63832)

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database

Vulnerable Configuration:Configuration 1:
  • cpe:/a:ibm:lotus_symphony:1.3.0.20090908.0900:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:ibm:lotus_symphony:1.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    ibm lotus symphony 1.3.0.20090908.0900
    ibm lotus symphony 1.3