full-disclosure - Re: DLL hijacking with Autorun on a USB drive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 14 Sep 2010 19:02:44 -0400
From: Larry Seltzer <larry@...ryseltzer.com>
To: Dan Kaminsky <dan@...para.com>, Stefan Kanthak <stefan.kanthak@...go.de>
Cc: full-disclosure@...ts.grok.org.uk, Valdis.Kletnieks@...edu
Subject: Re: DLL hijacking with Autorun on a USB drive

There's lots of ways for programmers to get this right, which is why
you're going to see a lot of patches coming out over a long period of
time. Forget the registry key, there's a SetDLLDirectory() API call
(http://msdn.microsoft.com/en-us/library/ms686203(VS.85).aspx ), although
it seems to me this should take a PATH-type string with multiple
directories rather than just one.

But since there's nothing Microsoft can impose without breaking lots of
apps, nothing systemic will be done. The fact that Microsoft is this
concerned about the number of apps that will be broken also illustrates
the extent of the problem, because each of those installations is likely
vulnerable.

-----Original Message-----
From: Dan Kaminsky [mailto:dan@...para.com]
Sent: Tuesday, September 14, 2010 6:54 PM
To: Stefan Kanthak
Cc: Larry Seltzer; full-disclosure@...ts.grok.org.uk;
Valdis.Kletnieks@...edu
Subject: Re: DLL hijacking with Autorun on a USB drive

On Tue, Sep 14, 2010 at 6:07 PM, Stefan Kanthak <stefan.kanthak@...go.de>
wrote:
> Dan Kaminsky wrote:
>
>> h0h0h0.  There be history, Larry.
>>
>> Short version:  Go see how many DLLs exist outside of
c:\windows\system32.
>> Look, ye mighty, and despair when you realize all those apps would be
broken
>> by CWD DLL blocking.
>
> No, that's the too much shortened version.
> The correct version but is: Go see how many DLLs exist outside of the
DLL
> search path.
> CWD DLL blocking does NOT break all those apps!
> Apps which install their DLLs into their own application directory won't
> notice CWD blocking at all.
>
> And apps which break can be easily fixed:
>
> [HKLM\Software\Microsoft\Windows\CurrentVersion\App
Paths\application.exe]
> "Path"=...
>
> exists for more than 15 years now.
>
> Stefan
>
>

An automatic patch that breaks random apps will not be an automatic
patch -- and neither will the twenty patches after it.

Nobody cares that the breakage "can be fixed" with some fifteen year old
key.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/