Untrusted Search Path Vulnerability in UltraVNC by UltraVNC Software

CVE-2010-5248

What is CVE-2010-5248?

The vulnerability in UltraVNC 1.0.8.2 arises from its handling of untrusted search paths, which allows local users to exploit the system. By placing a malicious vnclang.dll file in the current working directory—a directory containing a .vnc file—an attacker can elevate their privileges. Users who operate the application from a compromised location may inadvertently execute the Trojan horse, thus granting unauthorized access to system resources. This issue highlights the risks associated with improperly configured application paths and the importance of maintaining a secure software environment.

References