CVE-2010-2568
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Tags
Description
Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.
Analysis
Windows Shell improperly handles .LNK shortcut files during icon display, allowing local or remote attackers to execute arbitrary code. This vulnerability was famously exploited by the Stuxnet worm to propagate via USB drives in 2010.
Technical Context
Windows Explorer automatically parses .LNK files to display their icons. The vulnerability lies in how the shell processes specially crafted Control Panel shortcut references, causing Windows to load and execute a malicious DLL when merely displaying the shortcut's icon in Explorer.
Affected Products
['Microsoft Windows XP SP3', 'Microsoft Windows Server 2003 SP2', 'Microsoft Windows Vista SP1/SP2', 'Microsoft Windows Server 2008 SP2 and R2', 'Microsoft Windows 7']
Remediation
Apply Microsoft security update MS10-046. Disable the display of shortcut icons via Group Policy as a workaround. Implement USB device control policies.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today