Executive Summary
| Summary | |
|---|---|
| Title | Vulnerability in Windows Shell Could Allow Remote Code Execution (2286198) |
| Informations | |||
|---|---|---|---|
| Name | MS10-046 | First vendor Publication | 2010-08-02 |
| Vendor | Microsoft | Last vendor Modification | 2010-08-24 |
| Severity (Vendor) | Critical | Revision | 1.2 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Revision Note: V1.2 (August 24, 2010): Added an update FAQ to announce a detection change. This is a detection change only. There were no changes to the security update files in this bulletin. Customers who have already installed the update successfully do not need to reinstall.Summary: This security update resolves a publicly disclosed vulnerability in Windows Shell. The vulnerability could allow remote code execution if the icon of a specially crafted shortcut is displayed. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. |
Original Source
| Url : http://www.microsoft.com/technet/security/bulletin/MS10-046.mspx |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:11564 | |||
| Oval ID: | oval:org.mitre.oval:def:11564 | ||
| Title: | Windows Shell Vulnerability | ||
| Description: | Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-2568 | Version: | 9 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows 7 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Os | 1 | |
| Os | 1 | |
| Os | 4 | |
| Os | 2 | |
| Os | 2 |
SAINT Exploits
| Description | Link |
|---|---|
| Windows Shell LNK file CONTROL item command execution | More info here |
ExploitDB Exploits
| id | Description |
|---|---|
| 2010-09-21 | Microsoft Windows Shell LNK Code Execution |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-08-04 | Name : Microsoft Windows Shell Remote Code Execution Vulnerability (2286198) File : nvt/secpod_ms10-046.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 66387 | Microsoft Windows Shell LNK File Parsing Arbitrary Command Execution Windows contains a flaw that may allow an attacker to execute arbitrary code. The issue is triggered by a specially crafted .LNK or .PIF shortcut file which contains an icon resource that points to a malicious DLL file. |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2015-07-13 | Win.Trojan.Fanny outbound connection RuleID : 34857 - Revision : 2 - Type : MALWARE-CNC |
| 2014-01-10 | DNS request for known malware domain level4-co1-as30912.su RuleID : 28067 - Revision : 2 - Type : BLACKLIST |
| 2014-01-10 | DNS request for known malware domain level4-co2-as30938.su RuleID : 28066 - Revision : 2 - Type : BLACKLIST |
| 2014-01-10 | DNS request for known malware domain x2v9.com RuleID : 28065 - Revision : 2 - Type : BLACKLIST |
| 2014-01-10 | DNS request for known malware domain intelbackupsrv.su RuleID : 28064 - Revision : 2 - Type : BLACKLIST |
| 2014-01-10 | DNS request for known malware domain intelsystems.su RuleID : 28063 - Revision : 2 - Type : BLACKLIST |
| 2014-01-10 | DNS request for known malware domain intelsecurity.su RuleID : 28062 - Revision : 2 - Type : BLACKLIST |
| 2014-01-10 | DNS request for known malware domain intelcore.su RuleID : 28061 - Revision : 2 - Type : BLACKLIST |
| 2014-01-10 | Microsoft LNK shortcut arbitrary dll load attempt RuleID : 24500 - Revision : 6 - Type : FILE-OTHER |
| 2014-01-10 | Microsoft LNK shortcut download attempt RuleID : 19291 - Revision : 4 - Type : NETBIOS |
| 2014-01-10 | Microsoft LNK shortcut arbitary dll load attempt RuleID : 19290 - Revision : 9 - Type : FILE-OTHER |
| 2014-01-10 | Microsoft Windows PIF shortcut file download request RuleID : 17043 - Revision : 9 - Type : FILE-IDENTIFY |
| 2014-01-10 | Microsoft LNK shortcut arbitrary dll load attempt RuleID : 17042 - Revision : 17 - Type : FILE-OTHER |
Metasploit Database
| id | Description |
|---|---|
| 2010-07-16 | Microsoft Windows Shell LNK Code Execution |
| 2015-03-10 | Microsoft Windows Shell LNK Code Execution |
| 2015-03-10 | Microsoft Windows Shell LNK Code Execution |
| 2010-07-16 | Microsoft Windows Shell LNK Code Execution |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2010-08-02 | Name : The remote windows host is affected by a remote code execution vulnerability. File : smb_nt_ms10-046.nasl - Type : ACT_GATHER_INFO |
| 2010-07-18 | Name : It may be possible to execute arbitrary code on the remote Windows host using... File : smb_kb_2286198.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2020-05-23 13:17:13 |
|
| 2015-03-12 17:22:33 |
|
| 2014-02-17 11:46:36 |
|
| 2014-01-19 21:30:29 |
|
| 2013-05-11 00:49:39 |
|
