Vulnerability Description
Untrusted search path vulnerability in the Internet Connection Signup Wizard in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a Trojan horse smmscrpt.dll file in the current working directory, as demonstrated by a directory that contains an ISP or INS file, aka "Internet Connection Signup Wizard Insecure Library Loading Vulnerability."
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Windows Server 2003 | All versions |
| Microsoft | Windows Xp | All versions |
References
- http://www.exploit-db.com/exploits/14754/Exploit
- http://www.securitytracker.com/id?1024879
- http://www.us-cert.gov/cas/techalerts/TA10-348A.htmlUS Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-09
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
- http://www.exploit-db.com/exploits/14754/Exploit
- http://www.securitytracker.com/id?1024879
- http://www.us-cert.gov/cas/techalerts/TA10-348A.htmlUS Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-09
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
FAQ
What is CVE-2010-3144?
CVE-2010-3144 is a vulnerability with a CVSS score of 9.3 (HIGH). Untrusted search path vulnerability in the Internet Connection Signup Wizard in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a Trojan horse smmscrpt.d...
How severe is CVE-2010-3144?
CVE-2010-3144 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-3144?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Windows Server 2003, Microsoft Windows Xp.