[<prev] [next>] [day] [month] [year] [list]
Message-ID: <AANLkTi=qPR=DWV2tObvXio6FY9n9-GARFerWrUSRpwLP@mail.gmail.com>
Date: Fri, 10 Sep 2010 14:54:01 +0800
From: YGN Ethical Hacker Group <lists@...g.net>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
bugs@...uritytracker.com, vuln@...unia.com, secalert@...urityreason.com,
news@...uriteam.com, vuln@...urity.nnov.ru
Subject: Adobe Flash Player IE version 10.1.x Insecure DLL
Hijacking Vulnerability (dwmapi.dll)
=========================================================================================
Adobe Flash Player IE version 10.1.x Insecure DLL Hijacking
Vulnerability (dwmapi.dll)
=========================================================================================
1. OVERVIEW
The Flash Player application is vulnerable to Insecure DLL Hijacking
Vulnerability. Similar terms that describe this vulnerability
have been come up with Remote Binary Planting, and Insecure DLL
Loading/Injection/Hijacking/Preloading.
2. PRODUCT DESCRIPTION
Adobe Flash Player is the standard for delivering high-impact, rich
Web content. Designs, animation, and application user interfaces are
deployed immediately across all browsers and platforms, attracting and
engaging users with a rich Web experience.
3. VULNERABILITY DESCRIPTION
The Flash Player application passes an insufficiently qualified path
in loading its external libraries - "dwmapi.dll", which must be
present at user's desktop when a user visits web sites with flash
contents.
4. VERSIONS AFFECTED
10.1.x (other versions might be affected as well)
5. PROOF-OF-CONCEPT/EXPLOIT
http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/flash_player/poc/movie/flash_player_ie_10.x_dll_hijacking_vuln.mp4
Tested Platform:
OS: Windows XP Service Pack 3 (Fresh Windows)
Flash version: 10.1.82.76
6. IMPACT
Attackers can trigger a successful exploit against a victim user by
triggering user to save a malicious dll file in user's Desktop or if
user's default download save location is his Desktop. This is not a
case at least in the past where there have been cases such as old
versions of Apple Safari Browser automatically saving files in user'
desktop location, which implies that those who still have older
versions of Safari browser (version 3.1.1 and lower) are victims of
this issue.
7. SOLUTION
Fixed version from the vendor has not been released yet.
However, it is suggested that the following workaround be deployed by
users to protect increasing mass exploitation of this
vulnerability class:
- Avoid saving dll files from untrusted sources to Desktop location
8. VENDOR
Adobe Inc (http://www.adobe.com)
9. CREDIT
This vulnerability was discovered by Aung Khant, http://yehg.net, YGN
Ethical Hacker Group, Myanmar.
10. DISCLOSURE TIME-LINE
09-02-2010: vulnerability discovered
09-03-2010: notified vendor
09-10-2010: vulnerability disclosed
11. REFERENCES
Original Advisory URL:
http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/[flash_player]_10.1.x_insecure_dll_hijacking_(dwmapi.dll)
Related: http://aviv.raffon.net/2008/05/31/SafariPwnsInternetExplorer.aspx
Related: https://www.microsoft.com/technet/security/advisory/953818.mspx
Unofficial DLL Hijacking List:
http://www.corelan.be:8800/index.php/2010/08/25/dll-hijacking-kb-2269637-the-unofficial-list/
Testing for DLL Hijacking:
http://core.yehg.net/lab/pr0js/view.php/when_testing_for_dll_hijacking.txt
#yehg [09-10-2010]
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists