Title

Microsoft Groove Remote Code Execution Vulnerability (Cat II impact)

Discussion

Microsoft has released a security bulletin addressing a vulnerability affecting Microsoft Groove. To exploit this vulnerability, an attacker would entice a user to open a legitimate Groove related file (such as a .vcg or .gta file) that is located in the same network directory as a malicious dynamic link library (DLL) file. If successfully exploited, this vulnerability would allow an attacker to execute arbitrary code. At this time, there are known exploits associated with this vulnerability; USCYBERCOM is not aware of any DoD related incidents. Microsoft Groove Insecure Library Loading Vulnerability - (CVE-2010-3146): A remote code execution vulnerability exists in the way that Microsoft Groove 2007 handles the loading of DLL files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Check Content

See IAVM notice and vendor bulletin for additional information. Microsoft Bulletin MS11-016 (2494047) Vulnerable Applications/Systems: Microsoft Groove 2007 SP 2 Verify that the patch has been installed by checking that the following sample file is at the version indicated or later. See the vendor bulletin for additional information and any Vulnerable Systems\Applications not listed below. Groove.exe Microsoft Groove 2007 SP 2 - 12.0.6550.5004

Fix Text

Additional Identifiers

Rule ID:

Vulnerability ID: V-26092

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.