CVE-2010-2568

Published: Jul 22, 2010Modified: Apr 22, 2026CISA KEV

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.

Affected (10)

Products: Microsoft: Windows 7, Windows Server 2003, Windows Server 2008, Windows Vista, Windows Xp

5 products

Windows Server 2003

Windows Server 2008

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Microsoft Windows 7	All versions
Microsoft Windows Server 2003	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	Version r2
Microsoft Windows Server 2008	Version r2
Microsoft Windows Vista	All versions
Microsoft Windows Vista	All versions
Microsoft Windows Xp	All versions
Microsoft Windows Xp	All versions

References (29)

http://isc.sans.edu/diary.html?storyid=9181

Source: secure@microsoft.com

ExploitIssue Tracking

http://isc.sans.edu/diary.html?storyid=9190

Source: secure@microsoft.com

Issue Tracking

http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/

Source: secure@microsoft.com

Press/Media Coverage

http://secunia.com/advisories/40647

Source: secure@microsoft.com

Vendor Advisory

http://securitytracker.com/id?1024216

Source: secure@microsoft.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.f-secure.com/weblog/archives/00001986.html

Source: secure@microsoft.com

Not Applicable

http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf

Source: secure@microsoft.com

Exploit

http://www.kb.cert.org/vuls/id/940193

Source: secure@microsoft.com

PatchThird Party AdvisoryUS Government Resource

http://www.microsoft.com/technet/security/advisory/2286198.mspx

Source: secure@microsoft.com

Broken LinkPatchVendor Advisory

http://www.securityfocus.com/bid/41732

Source: secure@microsoft.com

Broken LinkExploitThird Party AdvisoryVDB Entry

http://www.us-cert.gov/cas/techalerts/TA10-222A.html

Source: secure@microsoft.com

Third Party AdvisoryUS Government Resource

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046

Source: secure@microsoft.com

PatchVendor Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11564

Source: secure@microsoft.com

Broken Link

https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm

Source: secure@microsoft.com

Third Party Advisory

http://isc.sans.edu/diary.html?storyid=9181

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue Tracking

http://isc.sans.edu/diary.html?storyid=9190

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/

Source: af854a3a-2127-422b-91ae-364da2661108

Press/Media Coverage

http://secunia.com/advisories/40647

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://securitytracker.com/id?1024216

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

http://www.f-secure.com/weblog/archives/00001986.html

Source: af854a3a-2127-422b-91ae-364da2661108

Not Applicable

http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.kb.cert.org/vuls/id/940193

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party AdvisoryUS Government Resource

http://www.microsoft.com/technet/security/advisory/2286198.mspx

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkPatchVendor Advisory

http://www.securityfocus.com/bid/41732

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkExploitThird Party AdvisoryVDB Entry

http://www.us-cert.gov/cas/techalerts/TA10-222A.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11564

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2568

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.