PRIOn knowledge basePRION:CVE-2010-1885Input validation
7.5 High
AI Score
Confidence
Low
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.974 High
EPSS
Percentile
99.9%
The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences, which allows remote attackers to bypass the trusted documents whitelist (fromHCP option) and execute arbitrary commands via a crafted hcp:// URL, aka โHelp Center URL Validation Vulnerability.โ
| CPE | Name | Operator | Version |
|---|---|---|---|
| windows_xp | eq | sp2x64 |
References
archives.neohapsis.com/archives/fulldisclosure/2010-06/0197.html
blogs.technet.com/b/msrc/archive/2010/06/10/windows-help-vulnerability-disclosure.aspx
blogs.technet.com/b/srd/archive/2010/06/10/help-and-support-center-vulnerability-full-disclosure-posting.aspx
secunia.com/advisories/40076
www.kb.cert.org/vuls/id/578319
www.microsoft.com/technet/security/advisory/2219475.mspx
www.securityfocus.com/archive/1/511774/100/0/threaded
www.securityfocus.com/archive/1/511783/100/0/threaded
www.securityfocus.com/bid/40725
www.securitytracker.com/id?1024084
www.us-cert.gov/cas/techalerts/TA10-194A.html
www.vupen.com/english/advisories/2010/1417
docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-042
exchange.xforce.ibmcloud.com/vulnerabilities/59267
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11733
www.exploit-db.com/exploits/13808
Related
7.5 High
AI Score
Confidence
Low
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.974 High
EPSS
Percentile
99.9%