Lucene search

MitreCVE-2010-3190

HistoryAug 31, 2010 - 8:00 p.m.

CVE-2010-3190

2010-08-3120:00:02

CWE-426

mitre

web.nvd.nist.gov

150

cve

2010

3190

microsoft

foundation class library

visual studio

mfc

vulnerability

local users

privileges

trojan horse

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.4

Confidence

High

EPSS

0.01

Percentile

83.3%

JSON

Untrusted search path vulnerability in the Microsoft Foundation Class (MFC) Library in Microsoft Visual Studio .NET 2003 SP1; Visual Studio 2005 SP1, 2008 SP1, and 2010; Visual C++ 2005 SP1, 2008 SP1, and 2010; and Exchange Server 2010 Service Pack 3, 2013, and 2013 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory during execution of an MFC application such as AtlTraceTool8.exe (aka ATL MFC Trace Tool), as demonstrated by a directory that contains a TRC, cur, rs, rct, or res file, aka “MFC Insecure Library Loading Vulnerability.”

Affected configurations

Nvd

Node

appleitunesMatch12.1.3

Node

microsoftvisual_c\+\+Match2005sp1redistributable_package

microsoftvisual_c\+\+Match2008sp1redistributable_package

microsoftvisual_c\+\+Match2010sp1redistributable_package

microsoftvisual_studioMatch2005sp1

microsoftvisual_studioMatch2008sp1

microsoftvisual_studioMatch2010-

microsoftvisual_studio_.netMatch2003sp1

VendorProductVersionCPE
appleitunes12.1.3cpe:2.3:a:apple:itunes:12.1.3:*:*:*:*:*:*:*
microsoftvisual_c\+\+2005cpe:2.3:a:microsoft:visual_c\+\+:2005:sp1:*:*:redistributable_package:*:*:*
microsoftvisual_c\+\+2008cpe:2.3:a:microsoft:visual_c\+\+:2008:sp1:*:*:redistributable_package:*:*:*
microsoftvisual_c\+\+2010cpe:2.3:a:microsoft:visual_c\+\+:2010:sp1:*:*:redistributable_package:*:*:*
microsoftvisual_studio2005cpe:2.3:a:microsoft:visual_studio:2005:sp1:*:*:*:*:*:*
microsoftvisual_studio2008cpe:2.3:a:microsoft:visual_studio:2008:sp1:*:*:*:*:*:*
microsoftvisual_studio2010cpe:2.3:a:microsoft:visual_studio:2010:-:*:*:*:*:*:*
microsoftvisual_studio_.net2003cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:*

Vendor	Product	Version	CPE
apple	itunes	12.1.3	cpe:2.3:a:apple:itunes:12.1.3:::::::*
microsoft	visual_c\+\+	2005	cpe:2.3:a:microsoft:visual_c\+\+:2005:sp1:::redistributable_package:::*
microsoft	visual_c\+\+	2008	cpe:2.3:a:microsoft:visual_c\+\+:2008:sp1:::redistributable_package:::*
microsoft	visual_c\+\+	2010	cpe:2.3:a:microsoft:visual_c\+\+:2010:sp1:::redistributable_package:::*
microsoft	visual_studio	2005	cpe:2.3:a:microsoft:visual_studio:2005:sp1::::::
microsoft	visual_studio	2008	cpe:2.3:a:microsoft:visual_studio:2008:sp1::::::
microsoft	visual_studio	2010	cpe:2.3:a:microsoft:visual_studio:2010:-::::::
microsoft	visual_studio_.net	2003	cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1::::::