bugtraq - Maxthon Browser version 2.5.15.1000 Insecure DLL Hijacking Vulnerability (dwmapi.dll)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 29 Aug 2010 00:16:35 +0800
From: YGN Ethical Hacker Group <lists@...g.net>
To: moderators@...db.org, full-disclosure@...ts.grok.org.uk,
	bugtraq@...urityfocus.com, bugs@...uritytracker.com,
	vuln@...unia.com, secalert@...urityreason.com, news@...uriteam.com,
	vuln@...urity.nnov.ru
Subject: Maxthon Browser version 2.5.15.1000 Insecure DLL Hijacking
 Vulnerability (dwmapi.dll)

1. OVERVIEW

The Maxthon Browser application is vulnerable to Insecure DLL
Hijacking Vulnerability. Similar terms that describe this
vulnerability
have been come up with Remote Binary Planting, and Insecure DLL
Loading/Injection/Hijacking/Preloading.

2. PRODUCT DESCRIPTION

Maxthon Browser is a powerful tabbed browser built for all users.
Besides basic browsing functionality,
it provides a rich set of features
(http://www.maxthon.com/overview.htm) to improve web surfing
experience.
it has got over 400,000K+ downloads and one of the famous browsers.

3. VULNERABILITY DESCRIPTION

The Maxthon Browser application passes an insufficiently qualified
path in loading an external library, "dwmapi.dll"
when a user opens its associated file with extensions - htm, html, mhtml.

4. VERSIONS AFFECTED

2.5.15.1000 and lower version family of 2.x.x.x

5. PROOF-OF-CONCEPT/EXPLOIT

http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/maxthon/poc/movie/
http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/maxthon/poc/maxthon.exe_2.5.15.1000_dwmapi.dll.zip

6. IMPACT

Attackers can trigger a successful exploit against a victim user
through a number of ways such as placing a malicious external
library file together with an interesting file in network shares,
distributing it via usb drives, embedding it in archive files
that are released through file sharing networks.

7. SOLUTION

Fixed version from the vendor has not been released yet.
However, it is suggested that the following workarounds be deployed by
users to protect increasing mass exploitation of this
vulnerability class:
- Disable loading of libraries from WebDAV and remote network shares
- Disable the WebClient service
Please see workaround solution links in References section.

8. VENDOR

Maxthon International Limited
http://www.maxthon.com/

9. CREDIT

This vulnerability was discovered by Aung Khant, http://yehg.net, YGN
Ethical Hacker Group, Myanmar.

10. DISCLOSURE TIME-LINE

08-28-2010: vulnerability discovered
08-28-2010: notified vendor
08-28-2010: vulnerability disclosed

11. REFERENCES

Original Advisory URL:
http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/[maxthon]_2.5.15.1000_insecure_dll_hijacking_(dwmapi.dll)
Workaround Solution: http://support.microsoft.com/kb/2264107
Workaround Solution:
https://www.microsoft.com/technet/security/advisory/2269637.mspx#EGF
Unofficial DLL Hijacking List:
http://www.corelan.be:8800/index.php/2010/08/25/dll-hijacking-kb-2269637-the-unofficial-list/

#yehg [08-28-2010]

---------------------------------
Best regards,
YGN Ethical Hacker Group
Yangon, Myanmar
http://yehg.net
Our Lab | http://yehg.net/lab
Our Directory | http://yehg.net/hwd