bugtraq - Notepad++ version 5.7 Insecure DLL Hijacking Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <AANLkTik3ttjwGgpUB6OVUGxZCphZdNVy2TBxnodh-df-@mail.gmail.com>
Date: Sat, 28 Aug 2010 20:50:46 +0800
From: YGN Ethical Hacker Group <lists@...g.net>
To: moderators@...db.org, full-disclosure@...ts.grok.org.uk,
	bugtraq@...urityfocus.com, bugs@...uritytracker.com,
	vuln@...unia.com, secalert@...urityreason.com, news@...uriteam.com,
	vuln@...urity.nnov.ru
Subject: Notepad++ version 5.7 Insecure DLL Hijacking Vulnerability

1. OVERVIEW

The Notepad++ application is vulnerable to Insecure DLL Hijacking
Vulnerability. Similar terms that describe this vulnerability
have been come up with Remote Binary Planting, and Insecure DLL
Loading/Injection/Hijacking/Preloading.

2. PRODUCT DESCRIPTION

Based on the powerful editing component Scintilla, Notepad++ is the
most powerful and famous open-source text editor written in C++
and uses pure Win32 API and STL which ensures a higher execution speed
and smaller program size. By optimizing as many routines as
possible without losing user friendliness, Notepad++ is trying to
reduce the world carbon dioxide emissions. When using less
CPU power, the PC can throttle down and reduce power consumption,
resulting in a greener environment.

3. VULNERABILITY DESCRIPTION

The Notepad++ application passes an insufficiently qualified path in
loading an external library, "scilexer.dll" when a user opens its
associated file
with extensions - css, inc, inf, ini, log, scp, wtx, shtml . This
vulnerability depends on the following situations -
- Notepad++ must have been made as the default text editor (so called
users' most favorite "Notepad" replacement)
- Affected extensions must not have been registered with other applications

4. VERSIONS AFFECTED

5.7 and lower

5. PROOF-OF-CONCEPT/EXPLOIT

http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/notepad++/poc/movie
http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/notepad++/poc/notepad++.exe_shtml_scilexer.dll.zip

6. IMPACT

Attackers can trigger a successful exploit against a victim user
through a number of ways such as placing a malicious external
library file together with an interesting file in network shares,
embedding it in archive files that are released through file
sharing networks.

7. SOLUTION

Fixed version from the vendor has not been released yet.
However, it is suggested that the following workarounds be deployed by
users to protect increasing mass exploitation of this
vulnerability class:
- Disable loading of libraries from WebDAV and remote network shares
- Disable the WebClient service
Please see workaround solution links in References section.

8. VENDOR

Notepad++ Developers Team
http://notepad-plus-plus.org/

9. CREDIT

This vulnerability was discovered by Aung Khant, http://yehg.net, YGN
Ethical Hacker Group, Myanmar.

10. DISCLOSURE TIME-LINE

08-28-2010: vulnerability discovered
08-28-2010: notified vendor
08-28-2010: vulnerability disclosed

11. REFERENCES

Original Advisory URL:
http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/[notepad++]_5.7_insecure_dll_hijacking
Workaround Solution: http://support.microsoft.com/kb/2264107
Workaround Solution:
https://www.microsoft.com/technet/security/advisory/2269637.mspx#EGF
Unofficial DLL Hijacking List:
http://www.corelan.be:8800/index.php/2010/08/25/dll-hijacking-kb-2269637-the-unofficial-list/

#yehg [08-28-2010]

---------------------------------
Best regards,
YGN Ethical Hacker Group
Yangon, Myanmar
http://yehg.net
Our Lab | http://yehg.net/lab
Our Directory | http://yehg.net/hwd