Vulnerabilities / Threats
10/28/2010
12:29 PM
50%
50%

Microsoft Windows Still Vulnerable To DLL Hijacking

Even patched applications aren't safe from bug, says ACROS security researcher.

Image Slideshow: Windows 7 Revealed
(click image for larger view)
Slideshow: Windows 7 Revealed

Even patched Windows applications remain vulnerable to dynamic link library (DLL) hijacking -- aka DLL planting and DLL loading -- attacks due to the erratic way in which Windows attempts to load DLLs.

That warning comes from a security advisory released on Wednesday by ACROS Security.

How can attackers take advantage of the DLL vulnerability? According to Microsoft: "When an application dynamically loads a dynamic link library (DLL) without specifying a fully qualified path name, Windows tries to locate the DLL by searching a well-defined set of directories. If an attacker gains control of one of the directories, they can force the application to load a malicious copy of the DLL instead of the DLL that it was expecting." As a result, attackers can execute arbitrary code using the current user's access level.

To help developers code applications that avoid this DLL-hijacking vulnerability, Microsoft had released SetDllDirectory. This function allows developers to eliminate the current working directory from Windows DLL searches, to frustrate attackers who might otherwise use that directory to hide malicious DLL files.

But developers can't rely on SetDllDirectory, because it behaves erratically, at least on Windows XP Professional 32 bit, Windows Vista Business 32 and 64 bit, and Windows 7 Professional 32 bit, said Mitja Kolsek, CEO of Acros Security.

The issue is that Windows often botches relative file location searches. "Until Microsoft fixes this bug, any application that sets user or system path can unwittingly make your application vulnerable to binary planting if you're loading libraries from relative paths," he said. Furthermore, even when developers write absolute paths, Windows may still treat them as relative ones, or alter other important variables after users log off and log back in.

To help, Kolsek urged developers to "use absolute, fully qualified paths to DLLs when loading them." While that won't block every type of DLL-hijacking attack, it will mitigate many of them.

Note that Microsoft's current DLL-hijacking hotfix does still work, at least against certain types of attacks. "This hotfix successfully blocks DLL loads from the current working directory if configured properly, even if relative locations are found in the PATH," said Kolsek. That said, it will not block executable files from exploiting the DLL hijacking vulnerability. To date, according to Secunia, a vulnerability information provider, 211 applications are vulnerable to DLL-hijacking attacks. So far, however, only 25 have been patched.

Comment  | 
Email This  | 
Print  | 
RSS
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
All Videos
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Cartoon Archive
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Back Issues | Must Reads
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.
FULL SCHEDULE | ARCHIVED SHOWS