Vulnerability Note VU#707943
Microsoft Windows based applications may insecurely load dynamic libraries
Some applications for Microsoft Windows may use unsafe methods for determining how to load DLLs. As a result, these applications can be forced to load a DLL from an attacker-controlled source rather than a trusted location.
Dynamically Linked Libraries (DLLs) are executable software components that are incorporated into a program at run-time rather than when the program is compiled and linked. Functions included in these libraries can be loaded in different ways by an application. In the case of run-time dynamic linking, a module uses the LoadLibrary() or LoadLibraryEx() functions to load the DLL at run time. If the location of the DLL to be loaded is not specified (such as specifying a fully qualified path name) by the application, Microsoft Windows defines an order in which directories are searched for the named DLL. By default, this search order contains the current directory of the process.
If an attacker can cause an affected application to call LoadLibrary() while the application's current directory is set to one controlled by the attacker, that application may run the attacker's code from a specially named DLL also supplied in that directory. This can occur when the affected application opens a normal file typically associated with it from the attacker-controlled directory. The specific name of the DLL that an attacker would need to choose varies depending on the affected application.
A remote, unauthenticated attacker with the ability to supply a malicious DLL may be able to execute arbitrary code on a vulnerable system. In the most likely exploit scenario, an attacker could host this malicious DLL on a USB drive or network share. The attacker-supplied code would be run with the privileges of the user of the affected application.
Apply a patch from the vendor
Developers of applications for the Windows platform should ensure that their applications call SetDllDirectory() with a blank path before calling LoadLibrary() to ensure that the DLL is not loaded from the current directory. More information about how to load libraries securely can be found in the following Microsoft articles: Dynamic-Link Library Security and Another technique for Fixing DLL Preloading attacks.
According to Microsoft Security Advisory 2269637:
Note This workaround requires installation of the tool described in Microsoft Knowledge Base Article 2264107.
Microsoft has released a tool which allows customers to disable the loading of libraries from remote network or WebDAV shares. This tool can be configured to disallow insecure loading on a per-application or a global system basis.
Customers who are informed by their vendor of an application being vulnerable can use this tool to help protect against attempts to exploit this issue.
Vendor Information (Learn More)
This list is known to be incomplete.
|Vendor||Status||Date Notified||Date Updated|
|Abvent||Affected||-||01 Sep 2010|
|Adobe||Affected||-||02 Sep 2010|
|Apple Inc.||Affected||-||30 Aug 2010|
|Atomix Productions||Affected||-||01 Sep 2010|
|Autodesk, Inc||Affected||-||02 Sep 2010|
|Avast! Antivirus Software||Affected||-||26 Aug 2010|
|Bentley Systems||Affected||-||02 Sep 2010|
|Bitmanagement Software||Affected||-||01 Sep 2010|
|BitTorrent||Affected||-||26 Aug 2010|
|Cisco Systems, Inc.||Affected||-||26 Aug 2010|
|Conceiva||Affected||-||09 Nov 2011|
|Corel Corporation||Affected||-||30 Aug 2010|
|CyberLink Corporation||Affected||30 Aug 2010||30 Aug 2010|
|DAEMON Tools||Affected||-||30 Aug 2010|
|Dassault Systemes||Affected||-||27 Sep 2010|
CVSS Metrics (Learn More)
Instances and variations of this vulnerability were independently discovered by a number of researchers, including Georgi Guninski; Simon Raner, Jure Skofic and Mitja Kolsek of ACROS Security; Taeho Kwon and Zhendong Su; H.D. Moore. Some vendor information comes from Secunia.
This document was written by Chad R Dougherty.
- CVE IDs: CVE-2010-1795
- Date Public: 18 Mar 98
- Date First Published: 25 Aug 2010
- Date Last Updated: 23 Jul 2012
- Severity Metric: 64.12
- Document Revision: 57
If you have feedback, comments, or additional information about this vulnerability, please send us email.