Vulnerability CVE-2010-3131
Published: 2010-08-26   Modified: 2012-02-13

Description:
Untrusted search path vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 on Windows XP allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .htm, .html, .jtx, .mfp, or .eml file.

See advisories in our WLB2 database:
Topic
Author
Date
Low
Firefox <= 3.6.8 DLL Hijacking Exploit [dwmapi.dll]
Glafkos Charalam...
27.08.2010

Type:

CWE-Other

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9.3/10
10/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Mozilla -> Firefox 
Mozilla -> Seamonkey 
Mozilla -> Thunderbird 

 References:
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html
http://www.exploit-db.com/exploits/14730
http://www.exploit-db.com/exploits/14783
http://www.mozilla.org/security/announce/2010/mfsa2010-52.html
http://www.securityfocus.com/archive/1/513324/100/0/threaded
http://www.vupen.com/english/advisories/2010/2169
http://www.vupen.com/english/advisories/2010/2201
http://www.vupen.com/english/advisories/2010/2323
https://bugzilla.mozilla.org/show_bug.cgi?id=579593
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12143
Copyright 2024, cxsecurity.com

 

Back to Top