CVEvulnerability
CVE-2010-0483
7.6 HIGH
Official page ↗
- Status
- Modified
- Published
- 2010-03-03
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.6 HIGH — AV:N/AC:H/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-94
Description
vbscript.dll in VBScript 5.1, 5.6, 5.7, and 5.8 in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used, allows user-assisted remote attackers to execute arbitrary code by referencing a (1) local pathname, (2) UNC share pathname, or (3) WebDAV server with a crafted .hlp file in the fourth argument (aka helpfile argument) to the MsgBox function, leading to code execution involving winhlp32.exe when the F1 key is pressed, aka "VBScript Help Keypress Vulnerability."
Affected configurations
• microsoft windows 2000
• microsoft windows 2003 server
• microsoft windows server 2003
• microsoft windows xp
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://blogs.technet.com/msrc/archive/2010/02/28/investigating-a-new-win32hlp-and-internet-explorer-issue.aspx Vendor Advisory
- http://blogs.technet.com/msrc/archive/2010/03/01/security-advisory-981169-released.aspx Vendor Advisory
- http://blogs.technet.com/srd/archive/2010/03/01/help-keypress-vulnerability-in-vbscript-enabling-remote-code-execution.aspx Vendor Advisory
- http://isec.pl/vulnerabilities/isec-0027-msgbox-helpfile-ie.txt Exploit
- http://isec.pl/vulnerabilities10.html Exploit
- http://secunia.com/advisories/38727 Vendor Advisory
- http://securitytracker.com/id?1023668 securitytracker.com
- http://www.computerworld.com/s/article/9163298/New_zero_day_involves_IE_puts_Windows_XP_users_at_risk www.computerworld.com
- http://www.kb.cert.org/vuls/id/612021 US Government Resource
- http://www.microsoft.com/technet/security/advisory/981169.mspx Vendor Advisory
- http://www.osvdb.org/62632 www.osvdb.org
- http://www.securityfocus.com/bid/38463 Exploit
- http://www.theregister.co.uk/2010/03/01/ie_code_execution_bug/ www.theregister.co.uk
- http://www.us-cert.gov/cas/techalerts/TA10-103A.html US Government Resource
- http://www.vupen.com/english/advisories/2010/0485 Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-022 docs.microsoft.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56558 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7170 oval.cisecurity.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8654 oval.cisecurity.org
- https://www.metasploit.com/svn/framework3/trunk/modules/exploits/windows/browser/ie_winhlp32.rb Exploit
- http://blogs.technet.com/msrc/archive/2010/02/28/investigating-a-new-win32hlp-and-internet-explorer-issue.aspx Vendor Advisory
- http://blogs.technet.com/msrc/archive/2010/03/01/security-advisory-981169-released.aspx Vendor Advisory
- http://blogs.technet.com/srd/archive/2010/03/01/help-keypress-vulnerability-in-vbscript-enabling-remote-code-execution.aspx Vendor Advisory
- http://isec.pl/vulnerabilities/isec-0027-msgbox-helpfile-ie.txt Exploit
- http://isec.pl/vulnerabilities10.html Exploit
- http://secunia.com/advisories/38727 Vendor Advisory
- http://securitytracker.com/id?1023668 securitytracker.com
- http://www.computerworld.com/s/article/9163298/New_zero_day_involves_IE_puts_Windows_XP_users_at_risk www.computerworld.com
- http://www.kb.cert.org/vuls/id/612021 US Government Resource
- http://www.microsoft.com/technet/security/advisory/981169.mspx Vendor Advisory
- http://www.osvdb.org/62632 www.osvdb.org
- http://www.securityfocus.com/bid/38463 Exploit
- http://www.theregister.co.uk/2010/03/01/ie_code_execution_bug/ www.theregister.co.uk
- http://www.us-cert.gov/cas/techalerts/TA10-103A.html US Government Resource
- http://www.vupen.com/english/advisories/2010/0485 Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-022 docs.microsoft.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56558 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7170 oval.cisecurity.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8654 oval.cisecurity.org
- https://www.metasploit.com/svn/framework3/trunk/modules/exploits/windows/browser/ie_winhlp32.rb Exploit