HTTP: Microsoft Windows winhlp32.exe MsgBox Remote Code Execution

A code execution vulnerability exists in Microsoft Windows. The vulnerability is caused by a design weakness in the Remote unauthenticated attackers can exploit this vulnerability by enticing the target user to open a malicious website and then press F1 key when a specially crafted dialog box is displayed. This may lead to execution of arbitrary code on the target system within the security context of the currently logged in user.

Extended Description

Microsoft VBScript is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Successful exploits will compromise the application and possibly the underlying computer. NOTE: Attackers must use social-engineering techniques to convince an unsuspecting user to press the 'F1' key when the attacker's message box prompts them to do so. NOTE: Microsoft reports that this issue can not be exploited on Windows Vista, Server 2008, 7, or Server 2008 R2. NOTE: This document previously mentioned a buffer-overflow affecting 'winhlp32.exe'. That issue has been moved to BID 38473 (Microsoft Internet Explorer 'winhlp32.exe' 'MsgBox()' Stack-Based Buffer Overflow Vulnerability) to better document it.

Affected Products

Avaya messaging_application_server,Microsoft vbscript

References

BugTraq: 38463

CVE: CVE-2010-0483

Short Name

HTTP:STC:WINHELP32-MSGBOX-RCE

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Windows winhlp32.exe MsgBox Remote Code Execution

Extended Description

Affected Products

References

Found a potential security threat?