lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 30 Dec 2015 11:14:07 +0100
From: <lists@...ossecurity.com>
To: "'Stefan Kanthak'" <stefan.kanthak@...go.de>, <fulldisclosure@...lists.org>
Subject: Re: [FD] Executable installers are vulnerable^WEVIL (case
	15):F-SecureOnlineScanner.exe allows arbitrary (remote)
	codeexecution and escalation of privilege

Hi Stefan and all,

> See the "CWDIllegalInDllSearchPath" setting introduced with KB2264107
> about 5 years ago, after ACROS finally got enough attention for the
> vulnerability first published as CVE-2000-0854 (that was 15 years ago,
> but the vulnerability is still present in ALL installation programs):
> there were^Ware applications that relied^Wy on loading DLLs from the
> CWD, so Microsoft CAN'T exclude CWD from the PATH.
> Microsoft can only offer support to exclude the CWD from the DLL search
> order: developers can call SetDllDirectory(""), administrators can add
> the global setting "CWDIllegalInDllSearchPath" or add this setting for
> individual programs.

While we finally did get CVE-2000-0854 the overdue attention, we apparently
didn't promote this enough:
http://blog.acrossecurity.com/2012/02/downloads-folder-binary-planting.html
(presented at Source Boston in 2012). So now you'll have to do it - good
luck :)

BTW, Stefan, soon you'll be able to create your own patches for these, and
many other bugs, with http://0patch.com. You're welcome.

Cheers,
Mitja

Mitja Kolsek, CEO / @mkolsek

ACROS, d.o.o.
Makedonska ulica 113, SI - 2000 Maribor, Slovenia
Tel +386.2.3000.280  Fax +386.2.3000.282
Web http://www.acrossecurity.com
Blg http://blog.acrossecurity.com
Twt @acrossecurity

ACROS Security: Finding Your Digital Vulnerabilities Before Others Do




_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists