CVE-2010-2568
Microsoft Windows Remote Code Execution Vulnerability
Description
CVE-2010-2568 is a remote code execution vulnerability in Microsoft Windows caused by the operating system's incorrect parsing of shortcut (.LNK) files. When Windows displays the icon of a specially crafted shortcut file, malicious code can be executed as the logged-on user without any additional user interaction. This vulnerability was famously exploited by the Stuxnet worm. With an EPSS score of 92.13% (99.71st percentile), CVE-2010-2568 remains one of the most dangerous Windows vulnerabilities. CISA added it to the KEV catalog on September 15, 2022.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 7 | - |
| microsoft | windows server 2003 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows vista | - |
| microsoft | windows xp | - |
References
- http://isc.sans.edu/diary.html?storyid=9181(Exploit, Issue Tracking)
- http://isc.sans.edu/diary.html?storyid=9190(Issue Tracking)
- http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/(Press/Media Coverage)
- http://secunia.com/advisories/40647(Vendor Advisory)
- http://securitytracker.com/id?1024216(Broken Link, Third Party Advisory, VDB Entry)
- http://www.f-secure.com/weblog/archives/00001986.html(Not Applicable)
- http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf(Exploit)
- http://www.kb.cert.org/vuls/id/940193(Patch, Third Party Advisory, US Government Resource)
- http://www.microsoft.com/technet/security/advisory/2286198.mspx(Broken Link, Patch, Vendor Advisory)
- http://www.securityfocus.com/bid/41732(Broken Link, Exploit, Third Party Advisory, VDB Entry)
- http://www.us-cert.gov/cas/techalerts/TA10-222A.html(Third Party Advisory, US Government Resource)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046(Patch, Vendor Advisory)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11564(Broken Link)
- https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2568(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
CVE-2010-2568 exploits improper input validation in Windows Shell's handling of shortcut (.LNK) files. The system fails to properly validate specially crafted shortcut data before using it to load resources, allowing malicious code referenced by the shortcut to execute when the shortcut icon is rendered.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2010-2568 allows remote code execution when Windows merely renders the icon of a malicious shortcut file, requiring no user clicks or interaction beyond browsing to a directory containing the malicious .LNK file. The vulnerability can be exploited via USB drives, network shares, WebDAV shares, or any medium that causes Windows Explorer to display the shortcut icon. Confidentiality, integrity, and availability are critically impacted as the executed code runs with the privileges of the logged-on user. The association with the Stuxnet worm demonstrates the vulnerability's use in sophisticated targeted attacks against critical infrastructure. The EPSS score of 92.13% confirms near-certain exploitation activity.
Exploit Maturity
CISA added CVE-2010-2568 to the KEV catalog on September 15, 2022, confirming continued active exploitation over a decade after disclosure. This vulnerability was first publicly identified as part of the Stuxnet worm, which targeted Iranian nuclear facilities in one of the most significant cyber operations in history. The EPSS score of 92.13% (99.71st percentile) indicates near-certain exploitation. The vulnerability has been incorporated into numerous malware families and exploitation frameworks. The ransomware association is classified as unknown, but the vulnerability's use in Stuxnet demonstrates its application in state-sponsored attacks.
Remediation
- Apply Microsoft security bulletin MS10-046: Install the Windows security update that corrects the .LNK file parsing vulnerability.
- Disable shortcut icon display: As a temporary mitigation, disable the display of shortcut icons through registry modifications, though this significantly impacts user experience.
- Block .LNK files at email gateways: Configure email security to strip or quarantine .LNK file attachments.
- Restrict removable media: Implement policies to disable autorun and restrict USB device access on critical systems.
- Update all Windows systems: Ensure no legacy Windows systems remain unpatched, and retire systems that can no longer receive security updates.
Technical Details
CVE-2010-2568 exploits a vulnerability in how Windows Shell parses shortcut (.LNK) files to display their icons. When Windows Explorer encounters a .LNK file, it attempts to load the referenced icon resource. The vulnerability exists in the Shell's handling of Control Panel shortcut items, where a specially crafted .LNK file can cause the Shell to load an arbitrary DLL file. The malicious DLL is loaded and executed in the context of Windows Explorer, granting the attacker code execution with the privileges of the current user. The exploit requires no user interaction beyond the display of the malicious shortcut — simply opening a folder in Explorer, inserting a USB drive, or browsing a network share containing the malicious .LNK file triggers execution. This zero-click nature made it ideal for the Stuxnet worm's air-gapped propagation via USB drives.
Frequently Asked Questions
Is CVE-2010-2568 being actively exploited?
Yes, CVE-2010-2568 continues to be actively exploited despite being disclosed in 2010. It was used by the Stuxnet worm and has been incorporated into numerous malware families. CISA added it to the KEV catalog in 2022.
What products are affected by CVE-2010-2568?
CVE-2010-2568 affects Microsoft Windows XP, Vista, 7, Server 2003, and Server 2008. Legacy systems still running these versions remain vulnerable.
How do I fix CVE-2010-2568?
Apply Microsoft security bulletin MS10-046. Systems running unsupported Windows versions should be upgraded or isolated from the network.
How severe is CVE-2010-2568?
CVE-2010-2568 has an EPSS score of 92.13% (99.71st percentile). It enables zero-click remote code execution through malicious shortcut files and was used in the Stuxnet worm targeting critical infrastructure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.