CVE-2010-1885

The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences, which allows remote attackers to bypass the trusted documents whitelist (fromHCP option) and execute arbitrary commands via a crafted hcp:// URL, aka "Help Center URL Validation Vulnerability."

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

74.29% chance of exploitation in the next 30 days, 99th percentile

Published

2010-06-14

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/13808

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_042_helpctr…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/16545
• https://www.exploit-db.com/exploits/13808

References

• CVE Record
• NVD entry

Related

• CVE-2010-1878
• CVE-2010-1887
• CVE-2010-1877
• CVE-2010-1888
• CVE-2010-1876
• CVE-2010-1889