CVEvulnerability
CVE-2010-0917
7.6 HIGH
Official page ↗
- Status
- Modified
- Published
- 2010-03-03
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.6 HIGH — AV:N/AC:H/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-119
Description
Stack-based buffer overflow in VBScript in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used, might allow user-assisted remote attackers to execute arbitrary code via a long string in the fourth argument (aka helpfile argument) to the MsgBox function, leading to code execution when the F1 key is pressed, a different vulnerability than CVE-2010-0483.
Affected configurations
• microsoft windows 2000
• microsoft windows 2003 server
• microsoft windows server 2003
• microsoft windows xp
Related
Weakness · CWE (1)
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
References
- http://blogs.technet.com/msrc/archive/2010/03/01/security-advisory-981169-released.aspx Vendor Advisory
- http://isec.pl/vulnerabilities/isec-0027-msgbox-helpfile-ie.txt Exploit
- http://isec.pl/vulnerabilities10.html Exploit
- http://www.microsoft.com/technet/security/advisory/981169.mspx Vendor Advisory
- http://www.securityfocus.com/bid/38473 Exploit
- http://www.theregister.co.uk/2010/03/01/ie_code_execution_bug/ www.theregister.co.uk
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56560 exchange.xforce.ibmcloud.com
- http://blogs.technet.com/msrc/archive/2010/03/01/security-advisory-981169-released.aspx Vendor Advisory
- http://isec.pl/vulnerabilities/isec-0027-msgbox-helpfile-ie.txt Exploit
- http://isec.pl/vulnerabilities10.html Exploit
- http://www.microsoft.com/technet/security/advisory/981169.mspx Vendor Advisory
- http://www.securityfocus.com/bid/38473 Exploit
- http://www.theregister.co.uk/2010/03/01/ie_code_execution_bug/ www.theregister.co.uk
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56560 exchange.xforce.ibmcloud.com