Microsoft IE winhlp32.exe服务远程代码执行漏洞(MS10-022)

🗓️ 14 Apr 2010 00:00:00Reported by RootType

Microsoft IE winhlp32.exe remote code execution vulnerability (MS10-022) and temporary mitigatio

Reporter	Title	Published	Views	Family All 20
Circl	CVE-2010-0483	2 Mar 201000:00	–	circl
Check Point Advisories	Microsoft VBScript MsgBox Call with Malicious HLP File (CVE-2010-0483)	2 Mar 201000:00	–	checkpoint_advisories
CVE	CVE-2010-0483	3 Mar 201019:00	–	cve
Cvelist	CVE-2010-0483	3 Mar 201019:00	–	cvelist
Exploit DB	Microsoft Internet Explorer - 'Winhlp32.exe' MsgBox Code Execution (MS10-023) (Metasploit)	28 Sep 201000:00	–	exploitdb
canvas	Immunity Canvas: IE_HELP	3 Mar 201019:30	–	canvas
Metasploit	MS10-022 Microsoft Internet Explorer Winhlp32.exe MsgBox Code Execution	15 Apr 201016:08	–	metasploit
NVD	CVE-2010-0483	3 Mar 201019:30	–	nvd
OpenVAS	Microsoft Internet Explorer 'VBScript' RCE Vulnerability	10 Mar 201000:00	–	openvas
OpenVAS	Microsoft VBScript Scripting Engine Remote Code Execution Vulnerability (980232)	14 Apr 201000:00	–	openvas


                                                &lt;html&gt;
&lt;title&gt;IE8, IE7 XP MsgBox PoC&lt;/title&gt;
&lt;body&gt;
&lt;script&gt;
if(navigator.userAgent.indexOf('MSIE') &lt; 0)
document.write('&lt;b&gt;Warn: Your browser isn\'t IE ? It won\'t work.&lt;/b&gt;');
&lt;/script&gt;
&lt;br&gt;&lt;br&gt;

This is simple demo for IE8/IE7 (only WinXP) vulnerability described here:&lt;br&gt;
&lt;a href=&quot;http://isec.pl/vulnerabilities/isec-0027-msgbox-helpfile-ie.txt&quot;&gt;http://isec.pl/vulnerabilities/isec-0027-msgbox-helpfile-ie.txt&lt;/a&gt;
&lt;br&gt;&lt;br&gt;&lt;br&gt;  
[+] The first one should spawn calc.exe after pressing F1.
&lt;br&gt;
&lt;FORM&gt;
&lt;INPUT TYPE=&quot;BUTTON&quot; VALUE=&quot;Calc.exe&quot; ONCLICK=&quot;window.location.href='box.html'&quot;&gt;
&lt;/FORM&gt;
&lt;br&gt;&lt;br&gt;
[+] The second one triggers stack overflow in winhlp32 process.
&lt;br&gt;
&lt;FORM&gt;
&lt;INPUT TYPE=&quot;BUTTON&quot; VALUE=&quot;Stack Overflow&quot; ONCLICK=&quot;window.location.href='box2.html'&quot;&gt;
&lt;/FORM&gt;

&lt;br&gt;&lt;br&gt;
iSEC 2010 (C) &lt;a href=&quot;http://twitter.com/mprodeus&quot;&gt;maurycy prodeus&lt;/a&gt;
&lt;/body&gt;
&lt;/html&gt;

14 Apr 2010 00:00Current

6.5Medium risk

Vulners AI Score6.5

EPSS0.83077