bugtraq - .NET Framework 4.6 allows side loading of Windows API Set DLL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <570D39F1.8010506@securify.nl>
Date: Tue, 12 Apr 2016 20:09:53 +0200
From: "Securify B.V." <lists@...urify.nl>
To: bugtraq@...urityfocus.com
Subject: .NET Framework 4.6 allows side loading of Windows API Set DLL

------------------------------------------------------------------------
.NET Framework 4.6 allows side loading of Windows API Set DLL
------------------------------------------------------------------------
Yorick Koster, February 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A DLL side loading vulnerability was found in the .NET Framework version
4.6 when running on Windows Vista or Windows 7. This issue can be
exploited by luring a victim into opening an Office document from the
attacker's share. An attacker can use this issue to execute arbitrary
code with the privileges of the target user. This can potentially result
in the attacker taking complete control of the affected system. If the
WebDAV Mini-Redirector is enabled, it is possible to exploit this issue
over the internet. This issue can be exploited even if the Office
document is opened in Protected View.

------------------------------------------------------------------------
See also
------------------------------------------------------------------------
- CVE-2016-0148
- MS16-041 : Security Update for .NET Framework (3148789)
- http://www.greyhathacker.net/docs/OfficeDLLhijacking.zip
- https://twitter.com/matthias_kaiser/status/697163250111291398
- 
http://hyp3rlinx.altervista.org/advisories/MICROSOFT-PPT-VIEWER-CODE-EXEC.txt

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully verified on Vista running Office 2010 and
.NET 4.6.81.0 & Windows 7 running Office 2013 and .NET 4.6.1055.0.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
Microsoft released MS16-041 that fixes this vulnerability.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://www.securify.nl/advisory/SFY20160201/_net_framework_4_6_allows_side_loading_of_windows_api_set_dll.html