Untrusted search path vulnerability in wab.exe 6.00.2900.5512 in Windows Address...
Vulnerability Description
Untrusted search path vulnerability in wab.exe 6.00.2900.5512 in Windows Address Book in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges via a Trojan horse wab32res.dll file in the current working directory, as demonstrated by a directory that contains a Windows Address Book (WAB), VCF (aka vCard), or P7C file, aka "Insecure Library Loading Vulnerability." NOTE: the codebase for this product may overlap the codebase for the product referenced in CVE-2010-3143.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2010-3147
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.us-cert.gov/cas/techalerts/TA10-348A.html
- http://www.exploit-db.com/exploits/14745/
- http://secunia.com/advisories/41050
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-096
- http://www.securitytracker.com/id?1024878
- http://www.attackvector.org/new-dll-hijacking-exploits-many/
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12352
More from microsoft
View All →Affected Vendor
microsoft
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.