Windows 7: Researcher: 40 Windows Apps Affected by Critical Flaw

Details...

Let me know if I understand that read. Itunes by Apple was made also for Windows and it took Apple a little time to figure out that Windows systems use DLL.

Here is another article from Computerworld that discusses the issue in depth.

wow. Thanks for heads up Win7user512 and BOM.

lol at comments on that page.

I dunno, it's almost not any different from saying that All OSes are completely insecure because they all allow people to DL and install programs.

Really, I'm serious. Even if every single other possible hole was fixed in every OS and every app, if you continue to let people individually develop, distribute and DL apps, you will have a GAPING unfixable vulnerabilities (As the mobile app market is finding out in spades right now).

This "trick" isn't really a trick at all, you still need to get the user to do something to "install" the file to start with, the difference between that and getting them to launch any random executable is pretty much nothing.

Update:

Article...

Another

And another...

And the microsoft fix:
A new CWDIllegalInDllSearch registry entry is available to control the DLL search path algorithm

That's not a "fix". There is no fix. That will break tons and TONS of existing code... An app can't even look in its own folder for its own shipping DLLs?

Go ahead and look through your programs files folders and look at all the programs that ship and install DLLs in their "CWD". I bet virtually NONE of them fully qualify and hand load their DLLs at runtime. NO ONE does that. The number of exeptions you would have to put in would be enourmous and pretty much make using the global flag pretty useless :/

I am serious when I say that this "abomination" is merely one step away from some reasearcher proclaiming that Windows is hopelessy insecure becuase after you buy it you can be tricked into installing a trojan app. I.e. It's time to stop allowing people to install applications as that is a /serious/ security hole. An elephant in the room so to say. (Not even Apples vetted app store is free from problem programs)

I smell an Onion Article...

Free upgrade to Win8 for everyone. no more Dll's... no backward compatibility. ? I don't know how they will fix this issue otherwise.

I wonder if MS was already suspecting this and trying to move forward away from it in case anyone found an exploit.