CVE-2010-3126

Опубликовано: 26 авг. 2010

Источник: nvd

CVSS2: 9.3

EPSS Низкий

Описание

Untrusted search path vulnerability in avast! Free Antivirus version 5.0.594 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse mfc90loc.dll that is located in the same folder as an avast license (.avastlic) file.

Комментарий

Per: http://cwe.mitre.org/data/definitions/426.html

'CWE-426 - 'Untrusted Search Path Vulnerability'

Ссылки

http://secunia.com/advisories/41109
Vendor Advisory
http://www.exploit-db.com/exploits/14743
Exploit
http://www.vupen.com/english/advisories/2010/2175
Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7193
http://secunia.com/advisories/41109
Vendor Advisory
http://www.exploit-db.com/exploits/14743
Exploit
http://www.vupen.com/english/advisories/2010/2175
Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7193

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:avast:avast_antivirus_free:*:*:*:*:*:*:*:*

Версия до 5.0.594 (включая)

EPSS

Процентиль: 82%

0.01696

Низкий

9.3 Critical

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-86m9-jwxx-2r6p

github

больше 3 лет назад