|
|
| |
Credit:
The information has been provided by Brett Moore.
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-10-016
|
| |
Vulnerable Systems:
* Microsoft Windows XP
User interaction is required in that the target must access a malicious URL.
The specific flaw exists within the ShellExecute API. Using a specially formatted URL an attacker can bypass sanitization checks within this function and force the calling application into running an executable of their choice.
Successful exploitation requires a useful binary to exist in a predictable location on the remote system.
Patch Availability:
Microsoft has issued an update to correct this vulnerability. More details can be found at the following Url:
http://www.microsoft.com/technet/security/bulletin/MS10-007.mspx
CVE Information:
CVE-2010-0027
Disclosure Timeline:
2009-07-20 - Vulnerability reported to vendor
2010-02-09 - Coordinated public release of advisory
|
|
|
