Windows Server 2008 Color Control Panel DLL Loading Arbitrary Code Execution Vulnerability

Bugtraq ID:	44157
Class:	Design Error
CVE:	CVE-2010-5082
Remote:	Yes
Local:	No
Published:	Oct 18 2010 12:00AM
Updated:	Feb 15 2012 05:40PM
Credit:	shinnai
Vulnerable:	Microsoft Windows Server 2008 R2 x64 SP1 Microsoft Windows Server 2008 R2 x64 0 Microsoft Windows Server 2008 R2 Itanium SP1 Microsoft Windows Server 2008 R2 Itanium 0 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2008 R2 Datacenter SP1 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for x64-based Systems R2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2008 Enterprise Edition SP2 Microsoft Windows Server 2008 Datacenter Edition SP2 Microsoft Windows Server 2008 R2 SP1 Microsoft Windows Server 2008 - Sp2 Enterprise X64 Avaya Aura Conferencing 6.0 Standard
Not Vulnerable:

Windows Server 2008 Color Control Panel DLL Loading Arbitrary Code Execution Vulnerability

Windows Server 2008 is prone to an arbitrary-code-execution vulnerability that affects the Color Control Panel library and lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

Windows Server 2008 Enterprise SP2 is vulnerable; others may also be affected.

Windows Server 2008 Color Control Panel DLL Loading Arbitrary Code Execution Vulnerability

A general exploit technique has been documented by TheLeader and H.D. Moore for the Metasploit Project; please see the references for more information.

Windows Server 2008 Color Control Panel DLL Loading Arbitrary Code Execution Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.


Microsoft Windows Server 2008 for 32-bit Systems SP2

• Microsoft Security Update for Windows Server 2008 (KB2643719)
  http://www.microsoft.com/downloads/details.aspx?familyid=3f6f89b3-3bc8 -4325-b8d8-9a5a398b99c6

Microsoft Windows Server 2008 R2 Itanium SP1

• Microsoft Security Update for Windows Server 2008 R2 for Itanium-based Systems (KB2643719)
  http://www.microsoft.com/downloads/details.aspx?familyid=fba58a1b-9d9f -4a10-b1df-08a0ebfa2358

Microsoft Windows Server 2008 for x64-based Systems R2

• Microsoft Security Update for Windows Server 2008 R2 x64 Edition (KB2643719)
  http://www.microsoft.com/downloads/details.aspx?familyid=8c51e09b-51c3 -4860-836e-6bcffde75f04

Microsoft Windows Server 2008 R2 for x64-based Systems SP1

• Microsoft Security Update for Windows Server 2008 R2 x64 Edition (KB2643719)
  http://www.microsoft.com/downloads/details.aspx?familyid=8c51e09b-51c3 -4860-836e-6bcffde75f04

Microsoft Windows Server 2008 for Itanium-based Systems SP2

• Microsoft Security Update for Windows Server 2008 for Itanium-based Systems (KB2643719)
  http://www.microsoft.com/downloads/details.aspx?familyid=d1d51b26-2d01 -42a9-9bb1-9fb82c1fb914

Microsoft Windows Server 2008 R2 Itanium 0

• Microsoft Security Update for Windows Server 2008 R2 for Itanium-based Systems (KB2643719)
  http://www.microsoft.com/downloads/details.aspx?familyid=fba58a1b-9d9f -4a10-b1df-08a0ebfa2358

Microsoft Windows Server 2008 for x64-based Systems SP2

• Microsoft Security Update for Windows Server 2008 x64 Edition (KB2643719)
  http://www.microsoft.com/downloads/details.aspx?familyid=35e6bd04-594f -42ef-97f8-abcf578b4f10

Microsoft Windows Server 2008 R2 x64 SP1

• Microsoft Security Update for Windows Server 2008 R2 x64 Edition (KB2643719)
  http://www.microsoft.com/downloads/details.aspx?familyid=8c51e09b-51c3 -4860-836e-6bcffde75f04

Windows Server 2008 Color Control Panel DLL Loading Arbitrary Code Execution Vulnerability

References:

• Application DLL Load Hijacking (HD Moore)
  
• Exploiting DLL Hijacking Flaws (hdm)
  
• Homepage (Microsoft)
  
• Microsoft Security Advisory 2269637 Released (Microsoft)
  
• More information about the DLL Preloading remote attack vector (Microsoft)
  
• ASA-2012-074 MS12-012 Vulnerability in Color Control Panel Could Allow Remote Co (Avaya)
  
• Microsoft Security Advisory (2269637) (Microsoft)
  
• Microsoft Security Bulletin MS12-012 (Microsoft)