New
#1
Microsoft still mum on programs prone to DLL hijacking attacks
Microsoft August 31 again abstained from naming which of its Windows programs, if any, contain bugs that could lead to widespread “DLL load hijacking” attacks.
Also August 31, the company published an automated tool to make it easier for users to block attacks exploiting vulnerabilities in a host of Windows applications.
The DLL load hijacking vulnerabilities exist in many Windows applications because the programs do not call code libraries — dubbed “dynamic-link library,” or “DLL” — using the full pathname, but instead use only the filename.
Criminals can exploit that by tricking the application into loading a malicious file with the same name as the required DLL.
The result: Hackers can hijack the PC and plant malware on the machine.
Although Microsoft again declined to call out its vulnerable software, outside researchers have identified as potential targets a number of its high-profile apps, including Word 2007, PowerPoint 2007 and 2010, Address Book and Windows Contact, and Windows Live Mail.
In another blog, an engineer with the Microsoft Security Response Center (MSRC) and an MSRC program manager, described how customers can deploy and use a tool Microsoft first offered August 23.
That tool blocks the loading of DLLs from remote directories, such as those on USB drives, Web sites and an organization’s network, and is aimed at enterprise IT personnel.
Source:
http://www.computerworld.com/s/article/9183078/Microsoft_still_mum_on_programs_prone_to_DLL_hijacking_attacks