Untrusted search path vulnerability in wab.exe 6.00.2900.5512 in Windows Address Book in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges via a Trojan horse wab32res.dll file in the current working directory, as demonstrated by a directory that contains a Windows Address Book (WAB), VCF (aka vCard), or P7C file, aka "Insecure Library Loading Vulnerability." NOTE: the codebase for this product may overlap the codebase for the product referenced in CVE-2010-3143.
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载:Microsoft Windows XP Media Center Edition SP3Microsoft WindowsXP-KB2423089-x86-ENU.exehttp://www.microsoft.com/downloads/details.aspx?familyid=46BAA431-126C -4FA5-9A7B-525008E2817DMicrosoft Windows 7 for 32-bit Systems 0Microsoft Windows6.1-KB2423089-x86.msuhttp://www.microsoft.com/downloads/details.aspx?familyid=4E8AD5CD-AF27 -4F00-9378-AD778B8EE7B3Microsoft Windows Server 2003 Web Edition SP2Microsoft WindowsServer2003-KB2423089-x86-ENU.exehttp://www.microsoft.com/downloads/details.aspx?familyid=E0B2837C-019B -419B-954D-5BDC71A3A332Microsoft Windows XP Professional x64 Edition SP2Microsoft WindowsServer2003.WindowsXP-KB2423089-x64-ENU.exehttp://www.microsoft.com/downloads/details.aspx?familyid=B9CE9D62-2EAA -48D8-BB6D-EA137E63D077Microsoft Windows Vista x64 Edition SP1Microsoft Windows6.0-KB2423089-x64.msuhttp://www.microsoft.com/downloads/details.aspx?familyid=73624B68-A69D -4517-B971-F0B7D2CCC9D6Microsoft Windows Server 2008 for Itanium-based Systems SP2Microsoft Windows6.0-KB2423089-ia64.msuhttp://www.microsoft.com/downloads/details.aspx?familyid=82F71194-6F1F -4F43-8752-4BF5E5F94A93Microsoft Windows 7 for x64-based Systems 0Microsoft Windows6.1-KB2423089-x64.msuhttp://www.microsoft.com/downloads/details.aspx?familyid=35A3E821-B463 -411C-858B-D01EB5AED42BMicrosoft Windows Server 2003 Standard Edition SP2Microsoft WindowsServer2003-KB2423089-x86-ENU.exehttp://www.microsoft.com/downloads/details.aspx?familyid=E0B2837C-019B -419B-954D-5BDC71A3A332Microsoft Windows Server 2003 Itanium SP2Microsoft WindowsServer2003-KB2423089-ia64-ENU.exehttp://www.microsoft.com/downloads/details.aspx?familyid=9ABC8270-F3AC -474D-9EBC-410AAA6262CCMicrosoft Windows Server 2008 for Itanium-based Systems R2Microsoft Windows6.1-KB2423089-ia64.msuhttp://www.microsoft.com/downloads/details.aspx?familyid=CB4211F3-1082 -4245-8F03-7CBAC90E9A31Microsoft Windows Server 2008 for Itanium-based Systems 0Microsoft Windows6.0-KB2423089-ia64.msuhttp://www.microsoft.com/downloads/details.aspx?familyid=82F71194-6F1F -4F43-8752-4BF5E5F94A93Microsoft Windows Vista x64 Edition SP2Microsoft Windows6.0-KB2423089-x64.msuhttp://www.microsoft.com/downloads/details.aspx?familyid=73624B68-A69D -4517-B971-F0B7D2CCC9D6