full-disclosure - Re: [FD] Executable installers are vulnerable^WEVIL (case 15):F-SecureOnlineScanner.exe allows arbitrary (remote) codeexecution and escalation of privilege

Open Source and information security mailing list archives

Message-ID: <000001d142ea$d1c4c850$754e58f0$@acrossecurity.com>
Date: Wed, 30 Dec 2015 11:14:07 +0100
From: <lists@...ossecurity.com>
To: "'Stefan Kanthak'" <stefan.kanthak@...go.de>, <fulldisclosure@...lists.org>
Subject: Re: [FD] Executable installers are vulnerable^WEVIL (case
	15):F-SecureOnlineScanner.exe allows arbitrary (remote)
	codeexecution and escalation of privilege

Hi Stefan and all,

> See the "CWDIllegalInDllSearchPath" setting introduced with KB2264107
> about 5 years ago, after ACROS finally got enough attention for the
> vulnerability first published as CVE-2000-0854 (that was 15 years ago,
> but the vulnerability is still present in ALL installation programs):
> there were^Ware applications that relied^Wy on loading DLLs from the
> CWD, so Microsoft CAN'T exclude CWD from the PATH.
> Microsoft can only offer support to exclude the CWD from the DLL search
> order: developers can call SetDllDirectory(""), administrators can add
> the global setting "CWDIllegalInDllSearchPath" or add this setting for
> individual programs.

While we finally did get CVE-2000-0854 the overdue attention, we apparently
didn't promote this enough:
http://blog.acrossecurity.com/2012/02/downloads-folder-binary-planting.html
(presented at Source Boston in 2012). So now you'll have to do it - good
luck :)

BTW, Stefan, soon you'll be able to create your own patches for these, and
many other bugs, with http://0patch.com. You're welcome.

Cheers,
Mitja

Mitja Kolsek, CEO / @mkolsek

ACROS, d.o.o.
Makedonska ulica 113, SI - 2000 Maribor, Slovenia
Tel +386.2.3000.280  Fax +386.2.3000.282
Web http://www.acrossecurity.com
Blg http://blog.acrossecurity.com
Twt @acrossecurity

ACROS Security: Finding Your Digital Vulnerabilities Before Others Do

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives