bugtraq - RE: Round One: "DLL Proxy" Attack Easily Hijacks SSL from Interne t Explorer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <08D18BEFE0F59E4EB2BB78107B5A527101AB7185@blaze.bcsc.gov.bc.ca>
Date: Tue, 10 Feb 2004 14:58:19 -0800
From: "Johnson, Jeff FOR:EX" <Jeff.S.Johnson@...s1.gov.bc.ca>
To: bugtraq@...urityfocus.com
Subject: RE: Round One: "DLL Proxy" Attack Easily Hijacks SSL from Interne
	t Explorer

> Yeah, but won't this break a lot of programs that install their DLL's 
> in their own directories by design, so that they may be installed by 
> users without administrative privileges on older versions of Windows? 

The change still allows use of DLLs in the application directory; it just
puts the System and Windows directories ahead of the 'current directory' in
the search order. (The Current directory and application EXE directory can
be different).

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/bas
e/loadlibraryex.asp

Actually, looking at that article, even with SafeDllSearchMode ON, it looks
like the application directory is still checked first and only the order of
the 'current directory' is changed to be after the Windows and System
directories. You'd have to test this to see what was really happening, to be
sure.

Jeff Johnson
Technical Development Analyst, MoF IMG
Jeff.S.Johnson@...s1.gov.bc.ca
(250) 356-6968