cvelistv5 - cve-2010-2568

CVE-2010-2568 (GCVE-0-2010-2568)

Vulnerability from cvelistv5

Published

2010-07-22 10:00

Modified

2025-10-22 00:05

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

Summary

Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.

References

URL

Tags

	http://www.us-cert.gov/cas/techalerts/TA10-222A.html	third-party-advisory, x_refsource_CERT
	http://isc.sans.edu/diary.html?storyid=9181	x_refsource_MISC
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11564	vdb-entry, signature, x_refsource_OVAL
	http://www.f-secure.com/weblog/archives/00001986.html	x_refsource_MISC
	http://www.kb.cert.org/vuls/id/940193	third-party-advisory, x_refsource_CERT-VN
	http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/	x_refsource_MISC
	http://secunia.com/advisories/40647	third-party-advisory, x_refsource_SECUNIA
	http://www.microsoft.com/technet/security/advisory/2286198.mspx	x_refsource_CONFIRM
	http://isc.sans.edu/diary.html?storyid=9190	x_refsource_MISC
	http://www.securityfocus.com/bid/41732	vdb-entry, x_refsource_BID
	http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf	x_refsource_MISC
	https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm	x_refsource_MISC
	http://securitytracker.com/id?1024216	vdb-entry, x_refsource_SECTRACK
	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046	vendor-advisory, x_refsource_MS

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

Date added: 2022-09-15

Due date: 2022-10-06

Required action: Apply updates per vendor instructions.

Used in ransomware: Unknown

Notes: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046; https://nvd.nist.gov/vuln/detail/CVE-2010-2568

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T02:39:36.528Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "TA10-222A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA10-222A.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://isc.sans.edu/diary.html?storyid=9181"
          },
          {
            "name": "oval:org.mitre.oval:def:11564",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11564"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.f-secure.com/weblog/archives/00001986.html"
          },
          {
            "name": "VU#940193",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/940193"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/"
          },
          {
            "name": "40647",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/40647"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.microsoft.com/technet/security/advisory/2286198.mspx"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://isc.sans.edu/diary.html?storyid=9190"
          },
          {
            "name": "41732",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/41732"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm"
          },
          {
            "name": "1024216",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1024216"
          },
          {
            "name": "MS10-046",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2010-2568",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-01T03:55:13.211673Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2022-09-15",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2568"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-22T00:05:52.095Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2568"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2022-09-15T00:00:00.000Z",
            "value": "CVE-2010-2568 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-07-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-12T19:57:01.000Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "TA10-222A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA10-222A.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://isc.sans.edu/diary.html?storyid=9181"
        },
        {
          "name": "oval:org.mitre.oval:def:11564",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11564"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.f-secure.com/weblog/archives/00001986.html"
        },
        {
          "name": "VU#940193",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/940193"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/"
        },
        {
          "name": "40647",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/40647"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.microsoft.com/technet/security/advisory/2286198.mspx"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://isc.sans.edu/diary.html?storyid=9190"
        },
        {
          "name": "41732",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/41732"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm"
        },
        {
          "name": "1024216",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1024216"
        },
        {
          "name": "MS10-046",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2010-2568",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "TA10-222A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA10-222A.html"
            },
            {
              "name": "http://isc.sans.edu/diary.html?storyid=9181",
              "refsource": "MISC",
              "url": "http://isc.sans.edu/diary.html?storyid=9181"
            },
            {
              "name": "oval:org.mitre.oval:def:11564",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11564"
            },
            {
              "name": "http://www.f-secure.com/weblog/archives/00001986.html",
              "refsource": "MISC",
              "url": "http://www.f-secure.com/weblog/archives/00001986.html"
            },
            {
              "name": "VU#940193",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/940193"
            },
            {
              "name": "http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/",
              "refsource": "MISC",
              "url": "http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/"
            },
            {
              "name": "40647",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/40647"
            },
            {
              "name": "http://www.microsoft.com/technet/security/advisory/2286198.mspx",
              "refsource": "CONFIRM",
              "url": "http://www.microsoft.com/technet/security/advisory/2286198.mspx"
            },
            {
              "name": "http://isc.sans.edu/diary.html?storyid=9190",
              "refsource": "MISC",
              "url": "http://isc.sans.edu/diary.html?storyid=9190"
            },
            {
              "name": "41732",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/41732"
            },
            {
              "name": "http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf",
              "refsource": "MISC",
              "url": "http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf"
            },
            {
              "name": "https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm",
              "refsource": "MISC",
              "url": "https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm"
            },
            {
              "name": "1024216",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1024216"
            },
            {
              "name": "MS10-046",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2010-2568",
    "datePublished": "2010-07-22T10:00:00.000Z",
    "dateReserved": "2010-06-30T00:00:00.000Z",
    "dateUpdated": "2025-10-22T00:05:52.095Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2010-2568",
      "cwes": "[\"CWE-20\"]",
      "dateAdded": "2022-09-15",
      "dueDate": "2022-10-06",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046; https://nvd.nist.gov/vuln/detail/CVE-2010-2568",
      "product": "Windows",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "Microsoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the operating system displays the icon of a malicious shortcut file. An attacker who successfully exploited this vulnerability could execute code as the logged-on user.",
      "vendorProject": "Microsoft",
      "vulnerabilityName": "Microsoft Windows Remote Code Execution Vulnerability"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.us-cert.gov/cas/techalerts/TA10-222A.html\", \"name\": \"TA10-222A\", \"tags\": [\"third-party-advisory\", \"x_refsource_CERT\", \"x_transferred\"]}, {\"url\": \"http://isc.sans.edu/diary.html?storyid=9181\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11564\", \"name\": \"oval:org.mitre.oval:def:11564\", \"tags\": [\"vdb-entry\", \"signature\", \"x_refsource_OVAL\", \"x_transferred\"]}, {\"url\": \"http://www.f-secure.com/weblog/archives/00001986.html\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"http://www.kb.cert.org/vuls/id/940193\", \"name\": \"VU#940193\", \"tags\": [\"third-party-advisory\", \"x_refsource_CERT-VN\", \"x_transferred\"]}, {\"url\": \"http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"http://secunia.com/advisories/40647\", \"name\": \"40647\", \"tags\": [\"third-party-advisory\", \"x_refsource_SECUNIA\", \"x_transferred\"]}, {\"url\": \"http://www.microsoft.com/technet/security/advisory/2286198.mspx\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"http://isc.sans.edu/diary.html?storyid=9190\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"http://www.securityfocus.com/bid/41732\", \"name\": \"41732\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\", \"x_transferred\"]}, {\"url\": \"http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"http://securitytracker.com/id?1024216\", \"name\": \"1024216\", \"tags\": [\"vdb-entry\", \"x_refsource_SECTRACK\", \"x_transferred\"]}, {\"url\": \"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046\", \"name\": \"MS10-046\", \"tags\": [\"vendor-advisory\", \"x_refsource_MS\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-07T02:39:36.528Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2010-2568\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-01T03:55:13.211673Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2022-09-15\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2568\"}}}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2022-09-15T00:00:00.000Z\", \"value\": \"CVE-2010-2568 added to CISA KEV\"}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2568\", \"tags\": [\"government-resource\"]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-04T19:19:06.617Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"datePublic\": \"2010-07-16T00:00:00.000Z\", \"references\": [{\"url\": \"http://www.us-cert.gov/cas/techalerts/TA10-222A.html\", \"name\": \"TA10-222A\", \"tags\": [\"third-party-advisory\", \"x_refsource_CERT\"]}, {\"url\": \"http://isc.sans.edu/diary.html?storyid=9181\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11564\", \"name\": \"oval:org.mitre.oval:def:11564\", \"tags\": [\"vdb-entry\", \"signature\", \"x_refsource_OVAL\"]}, {\"url\": \"http://www.f-secure.com/weblog/archives/00001986.html\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"http://www.kb.cert.org/vuls/id/940193\", \"name\": \"VU#940193\", \"tags\": [\"third-party-advisory\", \"x_refsource_CERT-VN\"]}, {\"url\": \"http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"http://secunia.com/advisories/40647\", \"name\": \"40647\", \"tags\": [\"third-party-advisory\", \"x_refsource_SECUNIA\"]}, {\"url\": \"http://www.microsoft.com/technet/security/advisory/2286198.mspx\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"http://isc.sans.edu/diary.html?storyid=9190\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"http://www.securityfocus.com/bid/41732\", \"name\": \"41732\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\"]}, {\"url\": \"http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"http://securitytracker.com/id?1024216\", \"name\": \"1024216\", \"tags\": [\"vdb-entry\", \"x_refsource_SECTRACK\"]}, {\"url\": \"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046\", \"name\": \"MS10-046\", \"tags\": [\"vendor-advisory\", \"x_refsource_MS\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"n/a\"}]}], \"providerMetadata\": {\"orgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"shortName\": \"microsoft\", \"dateUpdated\": \"2018-10-12T19:57:01.000Z\"}, \"x_legacyV4Record\": {\"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_value\": \"n/a\"}]}, \"product_name\": \"n/a\"}]}, \"vendor_name\": \"n/a\"}]}}, \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"http://www.us-cert.gov/cas/techalerts/TA10-222A.html\", \"name\": \"TA10-222A\", \"refsource\": \"CERT\"}, {\"url\": \"http://isc.sans.edu/diary.html?storyid=9181\", \"name\": \"http://isc.sans.edu/diary.html?storyid=9181\", \"refsource\": \"MISC\"}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11564\", \"name\": \"oval:org.mitre.oval:def:11564\", \"refsource\": \"OVAL\"}, {\"url\": \"http://www.f-secure.com/weblog/archives/00001986.html\", \"name\": \"http://www.f-secure.com/weblog/archives/00001986.html\", \"refsource\": \"MISC\"}, {\"url\": \"http://www.kb.cert.org/vuls/id/940193\", \"name\": \"VU#940193\", \"refsource\": \"CERT-VN\"}, {\"url\": \"http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/\", \"name\": \"http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/\", \"refsource\": \"MISC\"}, {\"url\": \"http://secunia.com/advisories/40647\", \"name\": \"40647\", \"refsource\": \"SECUNIA\"}, {\"url\": \"http://www.microsoft.com/technet/security/advisory/2286198.mspx\", \"name\": \"http://www.microsoft.com/technet/security/advisory/2286198.mspx\", \"refsource\": \"CONFIRM\"}, {\"url\": \"http://isc.sans.edu/diary.html?storyid=9190\", \"name\": \"http://isc.sans.edu/diary.html?storyid=9190\", \"refsource\": \"MISC\"}, {\"url\": \"http://www.securityfocus.com/bid/41732\", \"name\": \"41732\", \"refsource\": \"BID\"}, {\"url\": \"http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf\", \"name\": \"http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf\", \"refsource\": \"MISC\"}, {\"url\": \"https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm\", \"name\": \"https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm\", \"refsource\": \"MISC\"}, {\"url\": \"http://securitytracker.com/id?1024216\", \"name\": \"1024216\", \"refsource\": \"SECTRACK\"}, {\"url\": \"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046\", \"name\": \"MS10-046\", \"refsource\": \"MS\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"n/a\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2010-2568\", \"STATE\": \"PUBLIC\", \"ASSIGNER\": \"secure@microsoft.com\"}}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2010-2568\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-22T00:05:52.095Z\", \"dateReserved\": \"2010-06-30T00:00:00.000Z\", \"assignerOrgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"datePublished\": \"2010-07-22T10:00:00.000Z\", \"assignerShortName\": \"microsoft\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CERTA-2010-AVI-353

Vulnerability from certfr_avis

Une vulnérabilité dans le shell de Microsoft Windows permet l'exécution à distance de code arbitraire.

Description

Une vulnérabilité dans le shell de Microsoft Windows permet à un utilisateur distant malintentionné d'exécuter du code arbitraire avec les droits de l'utilisateur connecté sur la machine. Une erreur dans l'interprétation des fichiers raccourci permet d'exploiter cette vulnérabilité via l'affichage de l'icône d'un raccourci spécialement conçu.

Solution

Se référer au bulletin de sécurité Microsoft pour l'obtention des correctifs (cf. section Documentation).

Toutes les versions de Microsoft Windows.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Alerte CERTA-2010-ALE-009 du 19 juillet 2010	None	vendor-advisory
Alerte CERTA-2010-ALE-010 du 21 juillet 2010	None	vendor-advisory
Bulletin de sécurité Microsoft MS10-046 du 02 août 2010	None	vendor-advisory
Référence CVE CVE-2010-2568 :	-	other
Bulletin de sécurité Microsoft MS10-046 du 03 août 2010 :	-	other
Bulletin de sécurité Microsoft MS10-046 du 03 août 2010 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eToutes les versions de Microsoft Windows.\u003c/P\u003e",
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 dans le shell de Microsoft Windows permet \u00e0 un\nutilisateur distant malintentionn\u00e9 d\u0027ex\u00e9cuter du code arbitraire avec\nles droits de l\u0027utilisateur connect\u00e9 sur la machine. Une erreur dans\nl\u0027interpr\u00e9tation des fichiers raccourci permet d\u0027exploiter cette\nvuln\u00e9rabilit\u00e9 via l\u0027affichage de l\u0027ic\u00f4ne d\u0027un raccourci sp\u00e9cialement\ncon\u00e7u.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 Microsoft pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2010-2568",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2568"
    }
  ],
  "initial_release_date": "2010-08-03T00:00:00",
  "last_revision_date": "2010-08-03T00:00:00",
  "links": [
    {
      "title": "R\u00e9f\u00e9rence CVE CVE-2010-2568 :",
      "url": "http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2568"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS10-046 du 03 ao\u00fbt 2010 :",
      "url": "http://www.microsoft.com/technet/security/Bulletin/MS10-046.mspx"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS10-046 du 03 ao\u00fbt 2010 :",
      "url": "http://www.microsoft.com/france/technet/security/Bulletin/MS10-046.mspx"
    }
  ],
  "reference": "CERTA-2010-AVI-353",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-08-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans le \u003cspan class=\"textit\"\u003eshell\u003c/span\u003e de Microsoft\nWindows permet l\u0027ex\u00e9cution \u00e0 distance de code arbitraire.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans le Shell de Microsoft Windows",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Alerte CERTA-2010-ALE-009 du 19 juillet 2010",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2010-ALE-009/index.html"
    },
    {
      "published_at": null,
      "title": "Alerte CERTA-2010-ALE-010 du 21 juillet 2010",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2010-ALE-010/index.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS10-046 du 02 ao\u00fbt 2010",
      "url": null
    }
  ]
}

CERTA-2010-ALE-010

Vulnerability from certfr_alerte

Une vulnérabilité dans le shell Windows permet à un utilisateur distant malintentionné d'exécuter du code arbitraire.

Description

Une vulnérabilité du shell Windows existe dans la gestion des fichiers de raccourcis .lnk et permet l'exécution à distance de code arbitraire avec les droits de l'utilisateur connecté sur la machine.

Les fichiers .lnk permettent de créer des raccourcis vers des fichiers ou des répertoires.

Microsoft a mis à jour son avis pour indiquer que les fichiers .pif sont aussi vulnérables.

L'exploitation de la vulnérabilité survient lors de l'ouverture, via l'explorateur Windows, d'un dossier contenant les fichiers malformés. La méthode d'infection typique est l'ouverture d'une clé USB infectée, l'exploitation fonctionnant même si Autorun a été désactivé.

Cependant, les périphériques USB ne sont qu'un vecteur d'exploitation, la vulnérabilité peut être aussi exploitée via des partages réseaux, des liens WebDav, ou tout autre vecteur menant à l'affichage des fichiers malformés dans l'explorateur de fichier Windows.

Cette vulnérabilité est activement exploitée sur l'Internet (voir l'alerter CERTA-2010-ALE-009).

Contournement provisoire

Comme documenté dans l'avis Microsoft #2286198, la désactivation de l'affichage des icônes des raccourcis .lnk et .pif empêche l'exploitation de la vulnérabilité.

Microsoft a publié un FixIt permettant de déployer le contournement plus facilement (voir section Documentation).

La procédure manuelle est :

Faire une copie du contenu de la clé de registre :

HKEY_CLASSES_ROOT\lnkfile\shellex\IconHandler ;
Puis, editer la valeur «Par défaut» de cette clé et en supprimer le contenu ;
Faire une copie du contenu de la clé de registre :

HKEY_CLASSES_ROOT\piffile\shellex\IconHandler ;
Puis, editer la valeur «Par défaut» de cette clé et en supprimer le contenu ;
Redémarrer la machine ou explorer.exe.

Attention, cette manipulation désactive l'affichage de tous les icônes des raccourcis , y compris ceux du menu démarrer de Windows.

Solution

Se référer au bulletin de sécurité Microsoft pour l'obtention des correctifs (cf. section Documentation).

Toutes les versions de Microsoft Windows.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Avis de sécurité Microsoft #2286198 du 16 juillet 2010	None	vendor-advisory
Fixit Microsoft du 21 juillet 2010 :	-	other
Bulletin de sécurité Microsoft MS10-046 du 03 août 2010 :	-	other
Bulletin de sécurité Microsoft MS10-046 du 03 août 2010 :	-	other
Avis CERTA-2010-AVI-353 du 3 août 2010 :	-	other
Alerte CERTA-2010-ALE-009 du 16 juillet 2010 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eToutes les versions de Microsoft Windows.\u003c/P\u003e",
  "closed_at": "2010-08-03",
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 du shell Windows existe dans la gestion des fichiers\nde raccourcis .lnk et permet l\u0027ex\u00e9cution \u00e0 distance de code arbitraire\navec les droits de l\u0027utilisateur connect\u00e9 sur la machine.\n\nLes fichiers .lnk permettent de cr\u00e9er des raccourcis vers des fichiers\nou des r\u00e9pertoires.\n\nMicrosoft a mis \u00e0 jour son avis pour indiquer que les fichiers .pif sont\naussi vuln\u00e9rables.\n\nL\u0027exploitation de la vuln\u00e9rabilit\u00e9 survient lors de l\u0027ouverture, via\nl\u0027explorateur Windows, d\u0027un dossier contenant les fichiers malform\u00e9s. La\nm\u00e9thode d\u0027infection typique est l\u0027ouverture d\u0027une cl\u00e9 USB infect\u00e9e,\nl\u0027exploitation fonctionnant m\u00eame si Autorun a \u00e9t\u00e9 d\u00e9sactiv\u00e9.\n\nCependant, les p\u00e9riph\u00e9riques USB ne sont qu\u0027un vecteur d\u0027exploitation,\nla vuln\u00e9rabilit\u00e9 peut \u00eatre aussi exploit\u00e9e via des partages r\u00e9seaux, des\nliens WebDav, ou tout autre vecteur menant \u00e0 l\u0027affichage des fichiers\nmalform\u00e9s dans l\u0027explorateur de fichier Windows.\n\nCette vuln\u00e9rabilit\u00e9 est activement exploit\u00e9e sur l\u0027Internet (voir\nl\u0027alerter CERTA-2010-ALE-009).\n\n## Contournement provisoire\n\nComme document\u00e9 dans l\u0027avis Microsoft \\#2286198, la d\u00e9sactivation de\nl\u0027affichage des ic\u00f4nes des raccourcis .lnk et .pif emp\u00eache\nl\u0027exploitation de la vuln\u00e9rabilit\u00e9.\n\nMicrosoft a publi\u00e9 un FixIt permettant de d\u00e9ployer le contournement plus\nfacilement (voir section Documentation).\n\nLa proc\u00e9dure manuelle est :\n\n-   Faire une copie du contenu de la cl\u00e9 de registre :\n\n    `HKEY_CLASSES_ROOT\\lnkfile\\shellex\\IconHandler` ;\n\n-   Puis, editer la valeur \u00abPar d\u00e9faut\u00bb de cette cl\u00e9 et en supprimer le\n    contenu ;\n\n-   Faire une copie du contenu de la cl\u00e9 de registre :\n\n    `HKEY_CLASSES_ROOT\\piffile\\shellex\\IconHandler` ;\n\n-   Puis, editer la valeur \u00abPar d\u00e9faut\u00bb de cette cl\u00e9 et en supprimer le\n    contenu ;\n\n-   Red\u00e9marrer la machine ou explorer.exe.\n\nAttention, cette manipulation d\u00e9sactive l\u0027affichage de tous les ic\u00f4nes\ndes raccourcis , y compris ceux du menu d\u00e9marrer de Windows.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 Microsoft pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2010-2568",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-2568"
    }
  ],
  "initial_release_date": "2010-07-19T00:00:00",
  "last_revision_date": "2010-08-03T00:00:00",
  "links": [
    {
      "title": "Fixit Microsoft du 21 juillet 2010 :",
      "url": "http://support.microsoft.com/kb/2286198"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS10-046 du 03 ao\u00fbt 2010 :",
      "url": "http://www.microsoft.com/technet/security/Bulletin/MS10-046.mspx"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS10-046 du 03 ao\u00fbt 2010 :",
      "url": "http://www.microsoft.com/france/technet/security/Bulletin/MS10-046.mspx"
    },
    {
      "title": "Avis CERTA-2010-AVI-353 du 3 ao\u00fbt 2010 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2010-AVI-353"
    },
    {
      "title": "Alerte CERTA-2010-ALE-009 du 16 juillet 2010 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2010-ALE-009"
    }
  ],
  "reference": "CERTA-2010-ALE-010",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-07-19T00:00:00.000000"
    },
    {
      "description": "ajout de la vuln\u00e9rabilit\u00e9 des fichiers .lnk, modification de la section Contournement , ajout du FixIt Microsoft.",
      "revision_date": "2010-07-21T00:00:00.000000"
    },
    {
      "description": "ajout de la section Solution et ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 Microsoft dans la section Documentation. .",
      "revision_date": "2010-08-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans le \u003cspan class=\"textit\"\u003eshell\u003c/span\u003e Windows\npermet \u00e0 un utilisateur distant malintentionn\u00e9 d\u0027ex\u00e9cuter du code\narbitraire.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans le Shell de Microsoft Windows",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 Microsoft #2286198 du 16 juillet 2010",
      "url": "http://www.microsoft.com/technet/security/advisory/2286198.mspx"
    }
  ]
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2010-2568 (GCVE-0-2010-2568)

Vulnerability from cvelistv5

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

CERTA-2010-AVI-353

Vulnerability from certfr_avis

Description

Solution

CERTA-2010-ALE-010

Vulnerability from certfr_alerte

Description

Contournement provisoire

Solution

Tags

Sightings

Nomenclature