CVE-2010-3190
Summary
| CVE | CVE-2010-3190 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2010-08-31 20:00:00 UTC |
| Updated | 2020-11-16 19:33:00 UTC |
| Description | Untrusted search path vulnerability in the Microsoft Foundation Class (MFC) Library in Microsoft Visual Studio .NET 2003 SP1; Visual Studio 2005 SP1, 2008 SP1, and 2010; Visual C++ 2005 SP1, 2008 SP1, and 2010; and Exchange Server 2010 Service Pack 3, 2013, and 2013 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory during execution of an MFC application such as AtlTraceTool8.exe (aka ATL MFC Trace Tool), as demonstrated by a directory that contains a TRC, cur, rs, rct, or res file, aka "MFC Insecure Library Loading Vulnerability." |
Risk And Classification
Problem Types: CWE-426
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apple | Itunes | 12.1.3 | All | All | All |
| Application | Apple | Itunes | 12.1.3 | All | All | All |
| Application | Microsoft | Visual C | 2005 | sp1 | All | All |
| Application | Microsoft | Visual C | 2008 | sp1 | All | All |
| Application | Microsoft | Visual C | 2010 | sp1 | All | All |
| Application | Microsoft | Visual C | 2005 | sp1 | All | All |
| Application | Microsoft | Visual C | 2008 | sp1 | All | All |
| Application | Microsoft | Visual C | 2010 | sp1 | All | All |
| Application | Microsoft | Visual C | 2005 | sp1 | All | All |
| Application | Microsoft | Visual C | 2008 | sp1 | All | All |
| Application | Microsoft | Visual C | 2010 | sp1 | All | All |
| Application | Microsoft | Visual Studio | 2005 | sp1 | All | All |
| Application | Microsoft | Visual Studio | 2008 | sp1 | All | All |
| Application | Microsoft | Visual Studio | 2010 | - | All | All |
| Application | Microsoft | Visual Studio | 2005 | sp1 | All | All |
| Application | Microsoft | Visual Studio | 2008 | sp1 | All | All |
| Application | Microsoft | Visual Studio | 2010 | - | All | All |
| Application | Microsoft | Visual Studio .net | 2003 | sp1 | All | All |
| Application | Microsoft | Visual Studio .net | 2003 | sp1 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| About the security content of iTunes 12.3 - Apple Support | CONFIRM | support.apple.com | Vendor Advisory |
| portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2010-3190 | CONFIRM | portal.msrc.microsoft.com | Patch, Vendor Advisory |
| Microsoft ATL/MFC Trace Tool 'dwmapi.dll' DLL Loading Arbitrary Code Execution Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| Repository / Oval Repository | OVAL | oval.cisecurity.org | Third Party Advisory |
| Microsoft Security Bulletin MS11-025 - Important | Microsoft Docs | MS | docs.microsoft.com | Patch, Vendor Advisory |
| DLL Hijacking (KB 2269637) – the unofficial list | Peter Van Eeckhoutte's Blog | MISC | www.corelan.be | Broken Link |
| MS Visual Studio Insecure Library Loading Vulnerability - Advisories - Community | SECUNIA | secunia.com | Third Party Advisory |
| US-CERT Technical Cyber Security Alert TA11-102A -- Microsoft Updates for Multiple Vulnerabilities | CERT | www.us-cert.gov | Third Party Advisory, US Government Resource |
| APPLE-SA-2015-09-16-3 iTunes 12.3 | APPLE | lists.apple.com | Mailing List, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.