Signature Detail

HTTP:Microsoft Windows Common Control Library Vulnerability

This signature detects Web pages containing a dangerous SVG module. A malicious Web site can exploit a known vulnerability in Microsoft Windows Internet Explorer and gain control of the client browser.

Extended Description

Microsoft Windows Common Control Library is prone to a remote heap-based buffer-overflow vulnerability because the library fails to perform adequate boundary-checks on user-supplied data. Attackers can exploit this issue by enticing an unsuspecting user to open a specially crafted web page. Successful exploits can allow attackers to execute arbitrary code with the privileges of the user running the application. Failed exploit attempts will result in a denial-of-service condition.

Affected Products

• Avaya Aura Conferencing 6.0
• Avaya Aura Conferencing 6.0 Standard
• Avaya CallPilot Unified Messaging
• Avaya Communication Server 1000 Telephony Manager
• Avaya Meeting Exchange - Client Registration Server
• Avaya Meeting Exchange - Recording Server
• Avaya Meeting Exchange - Streaming Server
• Avaya Meeting Exchange - Web Conferencing Server
• Avaya Meeting Exchange - Webportal
• Avaya Messaging Application Server 4
• Avaya Messaging Application Server 5
• Avaya Messaging Application Server MM 1.1
• Avaya Messaging Application Server MM 2.0
• Avaya Messaging Application Server MM 3.0
• Avaya Messaging Application Server MM 3.1
• Avaya Messaging Application Server
• Microsoft Windows 7 for 32-bit Systems
• Microsoft Windows 7 for x64-based Systems
• Microsoft Windows Server 2003 SP2
• Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Beta 1
• Microsoft Windows Server 2003 Itanium SP2
• Microsoft Windows Server 2003 x64 SP2
• Microsoft Windows Server 2008 for 32-bit Systems SP2
• Microsoft Windows Server 2008 for 32-bit Systems
• Microsoft Windows Server 2008 for Itanium-based Systems R2
• Microsoft Windows Server 2008 for Itanium-based Systems SP2
• Microsoft Windows Server 2008 for Itanium-based Systems
• Microsoft Windows Server 2008 for x64-based Systems R2
• Microsoft Windows Server 2008 for x64-based Systems SP2
• Microsoft Windows Server 2008 for x64-based Systems
• Microsoft Windows Vista SP1
• Microsoft Windows Vista SP2
• Microsoft Windows Vista x64 Edition SP1
• Microsoft Windows Vista x64 Edition SP2
• Microsoft Windows XP Embedded SP3
• Microsoft Windows XP Home SP3
• Microsoft Windows XP Media Center Edition SP3
• Microsoft Windows XP Professional SP3
• Microsoft Windows XP Professional x64 Edition SP2
• Microsoft Windows XP Professional x64 Edition SP3
• Microsoft Windows XP Tablet PC Edition SP3

References

• BugTraq: 43717
• CVE: CVE-2010-2746
• URL: http://support.avaya.com/css/P8/documents/100113195
• URL: http://www.breakingpointsystems.com/community/blog/microsoft-vulnerability-proof-of-concept/
• URL: http://blogs.technet.com/b/srd/archive/2010/10/12/note-on-bulletin-severity-for-ms10-081-and-ms10-074.aspx