CVE-2010-1885 The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences, which allows remote at...
HighCVSS 9.3
EPSS 71.1%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences, which allows remote attackers to bypass the trusted documents whitelist (fromHCP option) and execute arbitrary commands via a crafted hcp:// URL, aka "Help Center URL Validation Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows 2003 server | All versions | No fix listed |
| Microsoft windows server 2003 | All versions | No fix listed |
| Microsoft windows xp | All versions | No fix listed |
References
- 20100609 Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly exploit mailing-list
- blogs.technet.com
- blogs.technet.com vendor-advisory
- 40076 third-party-advisory vendor-advisory
- 13808 exploit
- VU#578319 third-party-advisory us-government-resource
- www.microsoft.com vendor-advisory
- 20100609 Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly mailing-list
- 20100610 Re: Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly mailing-list
- 40725 exploit vdb-entry
- 1024084 vdb-entry
- TA10-194A third-party-advisory us-government-resource
- ADV-2010-1417 vdb-entry vendor-advisory
- MS10-042 vendor-advisory
- ms-win-helpctr-command-execution(59267) vdb-entry
- oval:org.mitre.oval:def:11733 signature vdb-entry