CVE-2010-3190

Published: Aug 31, 2010Modified: May 28, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Untrusted search path vulnerability in the Microsoft Foundation Class (MFC) Library in Microsoft Visual Studio .NET 2003 SP1; Visual Studio 2005 SP1, 2008 SP1, and 2010; Visual C++ 2005 SP1, 2008 SP1, and 2010; and Exchange Server 2010 Service Pack 3, 2013, and 2013 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory during execution of an MFC application such as AtlTraceTool8.exe (aka ATL MFC Trace Tool), as demonstrated by a directory that contains a TRC, cur, rs, rct, or res file, aka "MFC Insecure Library Loading Vulnerability."

Affected (8)

Products: Apple: Itunes · Microsoft: Visual C++, Visual Studio, Visual Studio .net

1 product

3 products

Visual Studio .net

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apple Itunes	Version 12.1.3

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Microsoft Visual C++	Version 2005 sp1
Microsoft Visual C++	Version 2008 sp1
Microsoft Visual C++	Version 2010 sp1
Microsoft Visual Studio	Version 2005 sp1
Microsoft Visual Studio	Version 2008 sp1
Microsoft Visual Studio	Version 2010
Microsoft Visual Studio .net	Version 2003 sp1

Related CWEs

Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

References (18)

http://lists.apple.com/archives/security-announce/2015/Sep/msg00003.html

Source: cve@mitre.org

Mailing ListVendor Advisory

http://secunia.com/advisories/41212

Source: cve@mitre.org

Third Party Advisory

http://www.corelan.be:8800/index.php/2010/08/25/dll-hijacking-kb-2269637-the-unofficial-list/

Source: cve@mitre.org

Broken Link

http://www.securityfocus.com/bid/42811

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.us-cert.gov/cas/techalerts/TA11-102A.html

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-025

Source: cve@mitre.org

PatchVendor Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12457

Source: cve@mitre.org

Third Party Advisory

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2010-3190

Source: cve@mitre.org

PatchVendor Advisory

https://support.apple.com/HT205221

Source: cve@mitre.org

Vendor Advisory

http://lists.apple.com/archives/security-announce/2015/Sep/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

http://secunia.com/advisories/41212

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.corelan.be:8800/index.php/2010/08/25/dll-hijacking-kb-2269637-the-unofficial-list/

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://www.securityfocus.com/bid/42811

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.us-cert.gov/cas/techalerts/TA11-102A.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-025

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12457

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2010-3190

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://support.apple.com/HT205221

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.