HTTP: Microsoft Windows Common Control Library Vulnerability

This signature detects Web pages containing a dangerous SVG module. A malicious Web site can exploit a known vulnerability in Microsoft Windows Internet Explorer and gain control of the client browser.

Extended Description

Microsoft Windows Common Control Library is prone to a remote heap-based buffer-overflow vulnerability because the library fails to perform adequate boundary-checks on user-supplied data. Attackers can exploit this issue by enticing an unsuspecting user to open a specially crafted web page. Successful exploits can allow attackers to execute arbitrary code with the privileges of the user running the application. Failed exploit attempts will result in a denial-of-service condition.

Affected Products

Avaya messaging_application_server,Microsoft windows_server_2008_for_itanium-based_systems

References

BugTraq: 43717

CVE: CVE-2010-2746

URL: http://support.avaya.com/css/P8/documents/100113195 http://www.breakingpointsystems.com/community/blog/microsoft-vulnerability-proof-of-concept/ http://blogs.technet.com/b/srd/archive/2010/10/12/note-on-bulletin-severity-for-ms10-081-and-ms10-074.aspx

Short Name

HTTP:STC:WIN-CCL-BOF

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Windows Common Control Library Vulnerability

Extended Description

Affected Products

References

Found a potential security threat?