CVE-2010-2568

critical-risk
Published 2010-07-22

Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.

Do I need to act?

!
92.1% chance of exploitation in next 30 days
EPSS score — higher than 8% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
2 public exploits available
14403, 16574
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10 High
LOCAL / LOW complexity

Affected Products (10)

Affected Vendors

Microsoft

References (29)

Exploit http://isc.sans.edu/diary.html?storyid=9181
Issue Tracking http://isc.sans.edu/diary.html?storyid=9190
Press/Media Coverage http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/
Vendor Advisory http://secunia.com/advisories/40647
Broken Link http://securitytracker.com/id?1024216
Not Applicable http://www.f-secure.com/weblog/archives/00001986.html
Exploit http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf
Patch http://www.kb.cert.org/vuls/id/940193
Broken Link http://www.microsoft.com/technet/security/advisory/2286198.mspx
Broken Link http://www.securityfocus.com/bid/41732
Third Party Advisory http://www.us-cert.gov/cas/techalerts/TA10-222A.html
Patch https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-04...
Broken Link https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3...
Third Party Advisory https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm
Exploit http://isc.sans.edu/diary.html?storyid=9181
Issue Tracking http://isc.sans.edu/diary.html?storyid=9190
Press/Media Coverage http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/
Vendor Advisory http://secunia.com/advisories/40647
Broken Link http://securitytracker.com/id?1024216
Not Applicable http://www.f-secure.com/weblog/archives/00001986.html
and 9 more references
74
/ 100
critical-risk
Severity 24/34 · High
Exploitability 34/34 · Critical
Exposure 16/34 · Moderate